Women’s Health USA Inc., an Avon, CT-based business associate that provides a range of practice management services to healthcare organizations, has experienced a phishing attack that has resulted in the exposure of patients’ protected health information.

An investigation was launched following the discovery of suspicious activity within certain employee email accounts. The affected email accounts were secured, and a leading cybersecurity firm was engaged to assist with the investigation and determine the nature and extent of the breach.

The investigation confirmed that the email accounts of two employees had been accessed by unauthorized individuals as a result of the employees responding to phishing emails and disclosing their email credentials. The first email account breach occurred on April 5, 2018 and the second account was breached on August 13, 2018.

A review of the emails and email attachments in the account revealed they contained a limited amount of protected health information. The exposed information varied from patient to patient but may have included name, date of birth, Medicare Health Insurance Claim Number (HICN), health insurance policy number, diagnosis information, treatment information, and Social Security number.

Women’s Health USA notified all affected healthcare provider clients about the breach on March 15, 2019 and started sending breach notification letters to all affected patients on March 29, 2019.

All employees have been provided with further training to help them identify phishing emails and to improve awareness of other cybersecurity issues. Additional security measures have also been implemented to enhance email security.

The phishing attack and data breach has been reported to the Department of Health and Human Services’ Office for Civil Rights. The breach summary indicates 17,531 patients were affected by the breach.

The post PHI of 17,531 Patients Potentially Compromised in Business Associate Phishing Attack appeared first on HIPAA Journal.

Palmetto Health – Now Prisma Health – has experienced a phishing attack that has resulted in several email accounts being accessed by unauthorized individuals.

Emails were sent to Palmetto Health employees which contained a malicious hyperlink. When the link in the emails was clicked, employees were directed to a realistic-looking web page where they were required to enter their email credentials. Doing so disclosed those credentials to the attackers, who used them to gain access to the email accounts.

A third-party computer forensics firm was retained to conduct an investigation into the breach to determine the nature and extent of access and whether any patients’ protected health information had been accessed or obtained.

The forensics firm determined that the first of the email accounts were compromised in November 2018. The review process took some time to complete as emails had to be manually checked to determine whether they contained any protected health information. The review process was completed on February 19, 2019 and revealed the protected health information of 23,811 patients had been exposed.

The exposed information was limited to names and information used by Palmetto Health when providing treatment or consultation. A small percentage of the emails also contained health insurance information, Social Security numbers, and/or financial information.

Palmetto Health believes the aim of the attack was to gain access to payroll information rather than to obtain patient health information. No evidence was uncovered to suggest any patient information was accessed or copied, but data theft could not be ruled out.

Complementary credit monitoring and identity theft protection services have been offered to all patients whose financial information has potentially been accessed.

Weslaco Regional Rehabilitation Hospital Patients Notified of Phishing Attack

Earnest Health has announced that certain patients who visited the Weslaco Regional Rehabilitation Hospital in Texas have had some of their protected health information exposed as a result of an October 2018 phishing attack.

The exposed information was limited to names, dates of birth, health insurance details, patient care information, driver’s license numbers, and Social Security numbers.

The hospital has notified all affected patients by mail and has offered complimentary credit monitoring and identity theft protection services to all patients whose driver’s license number or Social Security number was exposed.

Staff at the hospital are being provided with further training to help them identify potentially malicious emails.

The breach is not yet listed on the HHS’ Office for Civil Rights breach portal so it is currently unclear exactly how many patients were affected.

The post PHI of 23,811 Palmetto Health Patients Exposed in Phishing Attack appeared first on HIPAA Journal.

Massachusetts-based Baystate Health has experienced a phishing attack that has resulted in the exposure of the protected health information of approximately 12,000 patients.

Several employee email accounts were compromised between February 7 and March 7, 2019. The phishing attacks were identified during the same time frame and in each case, the compromised email accounts were immediately secured. A third-party computer forensics firm was engaged to assist with the investigation.

An analysis of the compromised email accounts revealed they contained patients’ names, dates of birth, diagnoses, treatment information, medications and, in some cases, Social Security numbers, health insurance information, and Medicare numbers.

All patients whose protected health information was potentially accessed as a result of the attack were notified by mail on April 5. Patients whose Social Security number was exposed have been offered one year of credit monitoring and identity theft protection services without charge.

Those services have been offered as a precaution. No evidence has been uncovered to suggest that the individuals behind the phishing attack viewed, copied, or misused patient information.

All patients affected by the breach have been urged to review statements from their providers and explanation of benefits statements from insurers to check that they have not been billed for medical services that have not been received.

Baystate Health performed a forced password reset on all affected accounts and has implemented controls to prevent employee email accounts from being accessed from outside the network unless specifically authorized.

Email logging and log reviews have also been increased to ensure that any future email account breaches are identified rapidly, and additional security awareness training is being provided to employees to help them detect and avoid phishing emails.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal, so the exact number of patients affected has not yet been confirmed.

The post 12,000 Patients of Baystate Health Notified of PHI Exposure Due to Phishing Attack appeared first on HIPAA Journal.

Oregon Endodontic Group has discovered malware has been installed on an office computer which potentially exported data contained in the office’s email account.

On November 13, 2018, Oregon Endodontic Group detected suspicious activity within an email account used at its offices.

A third -party forensic firm was engaged to assist with the investigation and identify the nature and scope of the security breach. The firm confirmed that a malware variant called Emotet had been downloaded onto an office computer. Emotet is a banking Trojan that is capable of exfiltrating data contained in email accounts. The computer forensics firm could not confirm whether any email data had been exfiltrated, but the possibility could not be ruled out.

The email account concerned was analyzed to determine whether it contained any protected health information. The analysis was completed on February 11, 2019.

The types of information contained in the account were limited to names along with one of more of the following data elements: Date of birth, diagnosis information, treatment information, and health insurance information. 41 individuals had their name and Social Security number exposed; seven individuals had their name and financial information exposed; and two individuals had their name and driver’s license number exposed.

Oregon Endodontic Group has engaged the services of an IT security firm which is assessing security controls and additional protections will be implemented as appropriate to enhance security.

Humana Notifies Members in Texas About Web Portal Breach

Humana has discovered unauthorized individuals have registered on the web portal used by one of its authorized service providers (Availity) and have attempted to obtain eligibility and benefit verification of plan members. The web portal is used by providers to check eligibility and benefits of multiple health plans.

The individuals posed as physician provider groups and potentially obtained a limited amount plan members’ information between January 15, 2016 and February 14, 2019.

The information potentially accessed was limited to names, Humana ID numbers, benefit information, plan effective dates, and care reminders. As a precaution, affected members have been offered credit monitoring and identity theft protection services and have been advised to monitor their explanation of benefits statements for signs of fraudulent activity. No reports of PHI misuse have been reported to date.

Humana notes in its breach notification letters that Availity did have policies and procedures in place to protect customer information and controls have now been augmented to prevent similar breaches in the future.

The breach affected 522 Humana members in Texas.

The post Emotet Malware Potentially Exfiltrated PHI of Oregon Endodontic Group Patients appeared first on HIPAA Journal.

993 Ohioans who receive benefits from Medicaid or the Ohio Department of Job and Family Services (ODJFS) are being notified that some of their protected health information has been disclosed to unauthorized individuals as a result of a computer error.

Three separate incidents were identified. On February 16, 2019, a computer error resulted in a limited amount of protected health information (PHI) of 250 users of the Ohio Benefits Self-Service Portal to appear in another user’s account. The error was identified and corrected the same day.

Two further incidents occurred on March 20, 2019. A computer error caused information entered into the Ohio Benefits portal to be saved to incorrect accounts. The computer error has been temporarily fixed and a permanent solution is being developed to prevent any recurrences. As many as 100 individuals were affected.

608 members of ODJFS, 34 recipients of Medicaid benefits, and one individual who received both types of benefits, had some of their PHI mailed to 5 different people as a result of a computer error. The computer error was corrected on March 22, 2019.

In all cases, the privacy breach was limited to names, contain information, dates of birth, case numbers, and claim numbers stored in the Ohio Benefits System. Affected individuals have been offered identity theft protection services for 12 months at no cost as a precaution.

840 University Hospitals Rainbow Babies & Children’s Hospital Patients Notified of Impermissible PHI Disclosure

University Hospitals Rainbow Babies & Children’s Hospital in Cleveland, OH, has discovered the PHI of 840 patients has been accidentally disclosed due to an error made by one of its employees.

The employee sent an email to a group of patients that contained a limited amount of personally identifiable information. The email was sent on February 28, and while information about patients was not detailed in the message, it implied that all individuals to whom the email had been sent suffer from the same medical condition.

The employee should have added the message recipients to the BCC field but made an error and included their emails in the ‘to’ field. As a result, the email addresses of all recipients of the email were visible to other members.

Al individuals affected have been notified of the privacy breach and the hospital has sanctioned the employee “in a manner deemed appropriate for the violation.” The employee has been reeducated on proper mail procedures and further education on patient privacy and HIPAA requirements will be provided to other staff members.

The post 1,600 Ohio Patients Notified of Impermissible PHI Disclosure appeared first on HIPAA Journal.

Main Line Endoscopy Centers, a network of outpatient endoscopy facilities in the Malvern, Bala Cynwyd, and Media regions of Pennsylvania, has discovered an unauthorized individual has gained access to the email account of one of its employees following a response to a phishing email.

It is not clear exactly when the account was breached, but it was discovered by Main Line on January 30, 2019.

A leading computer forensics firm was retained to assist with the investigation and determine which, if any, emails in the account had been opened and whether any patient information had been compromised. The investigation confirmed that the attackers potentially gained access to the protected health information of certain patients, which included names, dates of birth, and limited clinical information. Some patients also had their Social Security number, driver’s license number, and/or health insurance information exposed.

All patients affected by the breach were sent breach notification letters on March 29, 2019 and individuals whose Social Security number or driver’s license number were exposed have been offered complimentary identity theft protection services for 12 months at no cost.

As a precaution, all individuals affected by the breach have been advised to monitor their accounts, explanation of benefits statements, and credit reports closely for any sign of fraudulent use of their information.

To improve security and prevent further breaches, Main Line has provided further training to all staff to improve email security awareness and alert them to the threat from phishing. Multi-factor authentication has been implemented to prevent accounts from being accessed in the event that further credentials are compromised along with other security measures.

The breach has been reported to the Department of Health and Human Services’ Office for Civil Rights. The OCR breach portal indicates 14,305 patients were affected by the breach.

The post Phishing Attack Impacts 14,305 Patients of Main Line Endoscopy Centers appeared first on HIPAA Journal.