The Dallas, TX-based physician staffing company EmCare has announced that it has suffered a data breach that has impacted approximately 60,000 individuals, 31,000 of whom were patients.

The exposed information was detailed in emails and email attachments in employee email accounts that were accessed by an unauthorized individual after several employees responded to phishing emails and disclosed their email credentials. It is unclear from Emcare’s breach notice when the breach occurred and how long the attackers had access to email accounts.

The breach was discovered on February 19, 2019. An investigation was launched and, assisted by a third-party computer forensics company, it was discovered that the compromised email accounts contained information about patients, employees, and contractors. The following information was saved in email accounts and was potentially accessed or copied by the attackers: Names, dates of birth, driver’s license numbers, Social Security numbers, demographic information, and clinical information.

The investigation did not uncover evidence to suggest patient or employee information was accessed or exfiltrated by the attackers, although the possibility could not be ruled out. No reports have been received to suggest that patient or employee information has been misused to date.

Emcare is offering one year of credit monitoring and identity theft protection services at no cost to individuals whose Social Security number or driver’s license number was potentially compromised.

Notifications letters were sent to affected individuals on April 19, 2019, 59 days after the discovery of the breach – A day before the HIPAA Breach Notification Rule reporting deadline.

EmCare has responded to the breach by implementing a range of “advanced IT solutions” and employees have been provided with further training on email security.

The post 60,000 Records Exposed in EmCare Phishing Attack appeared first on HIPAA Journal.

The protected health information of 9,352 current and former employees of Klaussner Furniture Industries, Inc., and some dependents of those employees, has been exposed as a result of a security breach.

In February 2019, Klaussner Furniture learned that computers had been accessed by unauthorized individuals. A leading cybersecurity firm was retained to conduct a forensic investigation, which confirmed that two computers had been accessed by an unauthorized third party.

An analysis of the computers revealed they contained files that included first and last names, dates of birth, addresses, Social Security numbers, health benefit election(s), and some health information. No evidence was found that suggests employee information was accessed, copied, or misused, although it was not possible to rule out data access and exfiltration.

Individuals whose information was exposed had either worked at the company in 1998 or were employed at some point between 2004 and February 25, 2019. The sensitive information of dependents of those employees was only exposed if they had been listed on employees’ health benefit elections between 2004 and 2019.

Identify protection and monitoring services are being offered to all individuals affected by the breach for 12 months at no cost.

Klaussner Furniture has improved data security practices, rebuilt affected systems, and implemented additional security measures to prevent further unauthorized access. Additional security measures are also being explored which could further protect employee data.

Veteran Health Administration Notifies 4,882 Patients of Impermissible PHI Disclosure

The Veteran Health Administration (VHA) has discovered an error in a mailing app has resulted in the protected health information of patients being included in letters sent to other patients. To send letters containing protected health information to patients, VHA uses a Xerox software-powered app to pull relevant data from electronic medical records for inclusion in mailings.

An error resulted in other patients imaging results, lab test results, and appointment schedules being printed on letters. In each case, the PHI was disclosed to one other patient. The error occurred on February 13 and was discovered and corrected on February 16, 2019. During that time, letters had been mailed to 4,882 patients. Patients whose PHI was impermissibly disclosed had previously received medical services at Martinsburg VA Medical Center in West Virginia.

All individuals impacted by the breach have now been notified. The VHA is currently reviewing quality control procedures and will make updates as appropriate to prevent any further PHI disclosures.

The post Klaussner Furniture Industries Discovers Health Plan Data of 9,352 Employees Has Potentially Been Compromised appeared first on HIPAA Journal.

Centrelake Medical Group, a network of 8 medical imaging and oncology centers in California, is notifying certain patients that some of their protected health information has been exposed as a result of a computer virus.

The computer virus was discovered in February 2019 when it prevented the medical group from accessing its files. The virus appears to be a form of ransomware, although no mention of ransomware or a ransom demand was made in the media notice issued by Centrelake.

Centrelake retained a computer forensics company to assist with the investigation to determine the scope of the attack and whether any files containing protected health information had been accessed or copied.

The investigation revealed an unauthorized individual had gained access to its servers on January 9, 2019. Prior to deploying the virus on February 19, 2019, the unauthorized individual was able to access the servers undetected.

It is not unusual for ransomware to be installed on systems after hackers have breached security defenses. In some cases, ransomware is deployed after the system has been investigated and all valuable data has been exfiltrated. In this case, the computer forensics company did not uncover any evidence to suggest patient information was accessed or copied during the time that system access was possible, and no reports have been received to suggest any attempted or actual misuse of data has occurred.

The servers accessed by the unauthorized third party contained software applications and files that may have contained the following types of patient information: Names, phone numbers, addresses, Social Security numbers, health insurance information, diagnoses, services performed, dates of service, medical record numbers, referring provider information, and driver’s license numbers.

Centrelake Medical Group has told patients to be alert to the possibility of data misuse and suggests patients should monitor their financial accounts, credit reports, and explanation of benefits statements for any sign of fraudulent activity. A toll-free number has been set up for patients to obtain further information, but it does not appear that patients are being provided with credit monitoring and identity theft protection services.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal, so it is currently unclear exactly how many patients have been affected.

The post Centrelake Medical Group Discovers Servers Compromised and Virus Deployed appeared first on HIPAA Journal.

Riverplace Counseling Center in Anoka, MN, has discovered malware has been installed on its systems which may have allowed unauthorized individuals to gain access to patients’ protected health information.

The malware infection was discovered on January 20, 2019. The counseling center engaged an IT firm to conduct a forensic analysis, remove the malware, and restore its systems from backups. The analysis was completed on February 18, 2019.

The IT firm did not find evidence that suggested patient information had been subjected to unauthorized access or had been copied, but data access and PHI theft could not be totally ruled out.

The types on information stored on the affected systems included names, addresses, dates of birth, health insurance information, Social Security numbers, and treatment information.

Affected individuals were notified about the data breach on April 11, 2019 and have been offered identity theft monitoring services via Kroll for 12 months at no cost. No reports have been received to date to suggest any patients’ PHI has been misused.

Riverplace Counseling Center has not publicly disclosed what type of malware was involved, nor how the malware was installed on its systems.

To improve security and reduce the risk of further malware attacks, Riverplace Counseling Center has installed spam filters, upgraded its antivirus software and firewalls, and has provided further training to employees to help them identify unauthorized access.

The counseling center has also consulted with a cybersecurity firm which is providing recommendations on new system-wide policies and procedures to further enhance security.

According to the breach summary on the on the Department of Health and Human Services’ Office for Civil Rights website, up to 11,639 patients’ PHI was potentially compromised.

The post 11,639 Individuals Impacted by Riverplace Counseling Center Malware Attack appeared first on HIPAA Journal.

Gulf Coast Pain Consultants, dba Clearway Pain Solutions Institute, has discovered its EMR system has been accessed by an unauthorized individual.

An investigation was launched following the discovery of the breach on February 20, 2019. The investigation revealed the individual accessed a range of patient information.

The types of information that were accessed included patients’ names, telephone numbers, home addresses, email addresses, dates of birth, Social Security numbers, health insurance information, name of referring provider, and demographic information. Clinical information contained in medical records could not be accessed and no financial information was exposed.

Unauthorized access to the system has now been blocked, a full review of all EMR accounts has been conducted, and access levels and EMR system activity has been validated for all user accounts. A review of policies and procedures is being conducted with regards to the accessing of patient information and updates will be made as appropriate.

All patients affected by the breach are now being notified and are being offered 12 months of membership to Experian IdentityWorks at no cost.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal so it is unclear exactly how many patients have been affected.

Questcare Medical Services Discovers Email Account Breach

Questcare Medical Services, a Dallas, TX-based physician group, has announced the email account of an employee was compromised on February 13, 2019 as a result of a phishing attack. An investigation was immediately launched which revealed the compromised account contained protected health information. Affected patients were notified about the breach on April 12, 2019.

All individuals impacted by the breach had received medical services from Questcare in the Dallas, Fort Worth, or Arlington regions of Texas. The information potentially accessed by the attacker was limited to names, dates of birth and some clinical information. No sensitive financial information or Social Security numbers were exposed.

Questcare has provided further training to staff to improve security awareness and regular reminders about phishing will be sent to staff. Microsoft’s Advanced Threat Protection has also been implemented to provide enhanced protection against phishing attacks.

The number of individuals impacted by the breach has not yet been publicly disclosed.

RS Medical Experiences Phishing Attack

Vancouver, WA- based pain relief device manufacturer RS Medical has experienced a phishing attack that resulted in the email account of an employee being accessed by an unauthorized individual. The purpose of the attack appears to have been to gain access to a company account to send phishing emails rather than obtain sensitive patient information.

After gaining access to the account, the attacker sent around 10,000 phishing emails which alerted the company to the account breach. The breach was detected within 2 hours of the account being accessed.

While PHI access is not suspected, it could not be ruled out with a high degree of certainty. Notification letters have been sent to approximately 250 individuals whose PHI was included in the account.

The exposed PHI was limited to names, dates of birth, phone numbers, home addresses, diagnosis codes, and details of the medical equipment and supplies that had been provided by RS Medical.

The post Clearway Pain Solutions Institute Discovers Unauthorized EMR System Access appeared first on HIPAA Journal.

Metrocare Services, a provider of mental health services in North Texas, has experienced a phishing attack which saw the email accounts of several employees accessed by an unauthorized individual.

The breach was detected on February 6, 2019 and the affected email accounts were rapidly blocked to prevent further access. The investigation revealed the accounts were first compromised in January 2019.

An analysis of the affected accounts revealed they contained the protected health information of 5,290 patients. Patients were notified on April 5, 2019 that the following information could potentially have been accessed as a result of the attack: Name, date of birth, driver’s license information, health insurance information, health information related to the services provided by Metrocare, and for certain patients, Social Security numbers.

The breach investigation did not uncover any evidence to suggest emails containing ePHI had been accessed or copied, but ePHI access and theft could not be ruled out. Individuals whose Social Security number was exposed have been offered free access to identity theft protection and credit monitoring services for 12 months.

In response to the breach, Metrocare Services will be implementing additional security measures and will be strengthening the security of its email system. Multifactor authentication will also be implemented to prevent accounts from being accessed in the event that credentials are compromised in future attacks.

This is not the first phishing attack that Metrocare Services has experienced. Two months previously, in November 2018, the PHI of 1,800 patients was compromised in a similar attack. After that attack Metrocare Services said it was strengthening the security of its email system and had provided additional training to employees to help them identify potential phishing attacks.

Those measures were clearly not sufficient to prevent further attacks. Had multifactor authentication been implemented after the first phishing attack, the second, larger breach could potentially have been prevented.

The post Metrocare Services Suffers Second Phishing Attack in Two Months appeared first on HIPAA Journal.