Port St. Lucie, FL-based Communities Connected for Kids (CCK) has discovered an unauthorized individual gained access to databases containing the protected health information of child clients, their parents and staff members.

The breach was identified when suspicious activity was detected in the databases by one of its third-party vendors. An external computer forensics expert was hired to conduct an investigation which revealed access to the databases was first gained in August 2018. The breach was detected in March 2019 and access to the databases was promptly blocked.

During the 7 months that the individual had access to the databases, range of sensitive information was potentially viewed and downloaded.

The information exposed varied from individual to individual, but may have included name, contact information, date of birth, Social Security number, financial information, family information, Medicaid number, medical record number, prescription information, health insurance information, and medical and clinical information such as diagnoses and treatment information.

According to the breach report submitted to the Department of Health and Human Services’ Office for Civil Rights, 501 individuals were impacted by the breach. That figure may rise, as CCK is still conducting a review of the databases to determine the individuals whose information has been exposed. Once all individuals have been identified, notification letters will be sent, and affected individuals will be provided with free identity theft protection services.

CCK has identified the vulnerabilities which were exploited to gain access to the databases and is working hard to address those issues to ensure that security is improved and further breaches are prevented.

New York Health and Human Services Agency Breach Impacts 1,000 Individuals

People Inc., a not-for profit health and human services agency in Western New York which provides services to seniors and individuals with developmental disabilities, has experienced a phishing attack that has impacted approximately 1,000 individuals.

An investigation was launched on February 19, 2019 following the discovery of unauthorized access to its systems. A forensic investigation confirmed that an unauthorized individual had gained access to two employee email accounts after they responded to phishing emails.

Emails and attachments in the compromised accounts were discovered to include protected health information including names, addresses, Social Security numbers, insurance information, driver’s license numbers, government ID numbers, medical information and financial information.  At this stage, no information has been received to suggest any patient information has been misused.

People Inc., is offering affected individuals free credit monitoring services for one year. The HHS will be notified when People Inc., has confirmed the exact number of individuals affected. The FBI has already been notified about the breach.

The post 7 Month Data Breach Discovered by Communities Connected for Kids appeared first on HIPAA Journal.

Health Quest has announced it has suffered a phishing attack that has resulted in the exposure of certain patients’ protected health information.

The breach affected its affiliates Health Quest Medical Practice, Health Quest Urgent Care and Hudson Valley Newborn Physician Services, and the exposed information related to medical services provided to patients of those affiliates.

According to the breach notice on the Health Quest website, on April 2, 2019, Quest Health learned that patient information was contained in emails and email attachments in several employee email accounts that had been compromised as a result of a phishing attack.

Compromised protected health information included names, diagnoses, treatment information, dates of service, provider names, health insurance claims information and other information related to services received between January 2018 and June 2018.

When the breach was detected, the accounts were secured, and a leading cybersecurity firm was engaged to assist with the investigation. Quest Health has since implemented multi factor authentication and has strengthened email security to prevent further breaches. Breach notification letters are being mailed to affected individuals and should be received in the mail by June 10, 2019.

While the time frame for sending notifications appears to be in line with HIPAA requirements (April to June), the phishing attack actually occurred and was detected in July 2018.

According to Health Quest, “On January 25, 2019, Health Quest Affiliates identified email attachments that contained certain health information, and on April 2, 2019, were determined to contain patient information.”

Notification letters were therefore sent 11 months after the email accounts were compromised, and five months after it was first determined that some health information had been exposed. It is unclear why it took so long to determine that the compromised accounts contained PHI.

Breach Reporting Delays Can Prove Costly

There have been several breaches reported recently where the breaches have occurred several months previously, and notifications have only been issued after investigations have been completed.

Naturally, it is not possible to send notifications to affected individuals until those individuals have been identified, but the HHS is quite clear about the requirement to report breaches promptly and within 60 days of the discovery of the breach.

The discovery date is the date when the breach is discovered, not the date when the total number of individuals affected has been determined. OCR notifications are required within 60 days and addenda can be added to the breach reports when further information becomes available, such as the total number of affected individuals.

State attorneys general and OCR have taken action against organizations in the past over delayed breach notifications and have issued regulatory fines.

The post Health Quest Patients Notified of Historic Phishing Breach appeared first on HIPAA Journal.

The Cincinnati-based health system TriHealth is alerting 2,433 patients about an impermissible disclosure of their protected health information (PHI) to a student mentee.

The student was acting under the direct supervision of a former TriHealth physician and accessed patient information for a potential research project. On June 8 and June 9, 2018, the student was provided with patient information including first and last names, dates of birth, ethnicity, life status, cancer diagnosis information, and zip codes.

TriHealth does not believe that there were any further uses or disclosures of patient information nor that any patient information has been misused. PHI was accessed solely in relation to the potential research project.

Since the student was not an approved TriHealth workforce member, access to patient information was prohibited. As such, this was an impermissible disclosure of patient information which warranted breach notifications to be issued to affected patients. Those notification letters have now been sent.

In its website breach notice, TriHealth said all employees are educated on the hospital’s privacy policies when they are hired and are required to undergo annual re-training. In the event of a violation of hospital policy, corrective action is taken which can include discharge from employment. That process was followed in this case.

Centura Health Email Compromise Impacts 7,515 Patients

The Centennial, CO-based health system Centura Health is alerting 7,515 patients about an email security incident that exposed some of their PHI.

Centura Health discovered the breach on April 16, 2019 and promptly secured the affected email account. A forensic investigation confirmed that the account had been accessed by an unauthorized individual who may have viewed or obtained patient information contained in emails and email attachments. No evidence was uncovered to suggest PHI has been accessed, stolen, or misused, but patients are being notified as a precaution. Letters started to be sent on May 22, 2019.

Patients affected by the breach had some or all of the following information exposed: Name, date of birth, demographic information, medical record number, account number, dates of service, treating physician, services received, medical device supplied, and other clinical information. No health insurance information, financial data, or Social Security numbers were exposed.

Centura Health has taken steps to reduce the risk of further email security breaches, including re-educating the workforce on email security, establishing and using strong passwords, and strengthening email security protections.

Phishing Attack Reported by Columbus Community Hospital

Columbus Community Hospital in Columbus, WI, is alerting certain patients that some of their PHI has been exposed as a result of a phishing attack on one of its business associates.

On April 8, 2019, the claims management service provider OS, Inc., notified Columbus Community Hospital that an unauthorized individual had gained access to the email account of one of its employees and may have viewed patient information.

The information in the compromised account includes names, hospital account numbers, insurer names, summaries of charges, and categories of service. A limited number of patients also had their insurance ID number and/or Social Security number exposed. No evidence of data access, theft, or misuse has been identified to date.

OS Inc., provides claims management services to several hospitals. It is currently unclear whether the breach was limited to Columbus Community Hospital or if patients of other hospitals have also been affected.

The breach has yet to appear on the HHS’ Office for Civil Rights website so it is not yet known how many individuals have been affected.

The post Data Breaches Reported by TriHealth, Centura Health, and Columbus Community Hospital appeared first on HIPAA Journal.

Thousands of medical records have been found abandoned in a publicly accessible dumpster in Texas. The boxes contain records of Today’s Vision patients and employees and include paperwork containing highly sensitive information.

Today’s Vision has more than 50 independently owned and operated optometry clinics throughout Texas. Most of the records appear to have come from Today’s Vision in Willowbrook in northwest Houston. The Willowbrook location is no longer operational and was sold to MyEyeDr three months ago.

Dr. Donald Glenz owned and ran both the Willowbrook and Tomball Today’s Vision offices, prior to the sale to MyEyeDr in February. Dr. Glenz is unaware how the files came to be dumped and who is responsible. Dr. Glenz told KPRC that the incident is being investigated to determine who was responsible. Prior to any records being deleted they are usually shredded in accordance with HIPAA requirements but that did not occur in this instance. Today’s Vision executive director Greg Watson described the discovery as ‘disturbing.’

The incident is also being investigated by MyEyeDr and the Department of Health and Human Services is working closely with the police department and is investigating the HIPAA violation.

Over 20 boxes of records were discovered in a dumpster behind the strip mall in Tomball, which is several miles away from the offices where the records were held. The boxes have been recovered by Tomball Police department and are being securely stored.

The records appear to relate to patients who received vision services between 1997 and 2013 and staff who served at Willowbrook location in the same time period.

The types of information in the paperwork include names, addresses, phone numbers, payment information, insurance information, limited health histories, and Social Security numbers. Employee information includes work related information such as resumes, immigration status, vacation requests, payment information, and some personal information.

The post Boxes of Records of Today’s Vision Patients and Employees Discovered in Texas Dumpster appeared first on HIPAA Journal.