Pasquotank-Camden Emergency Medical Services (PCEMS) has discovered hackers have infiltrated a server that housed its billing system, which contained the protected health information of 20,420 patients.

As a result of the intrusion, the hackers potentially gained access to the highly sensitive information of individuals who had previously received medical services from PCEMS.

The types of information stored on the server included names, birth dates, Social Security numbers, and some medical information that had been collected by PCEMS.

The breach was reported immediately to the Sheriff of Pasquotank County and federal law enforcement agencies, who determined that the hackers were based outside the United States. No evidence was found to indicate patients’ protected health information was stolen and at the time of issuing notification letters to patients, no reports had been received to suggest patient information had been misused.

Since data theft could not be ruled out, PCEMS has offered all affected patients 12 months of free credit monitoring and identity theft protection services through ID Experts. Affected patients will also be covered by a $1,000,000 insurance reimbursement policy. Enrollment in these services is not automatic. Patients have until May 26, 2019 to register for the services.

PCEMS is now reviewing its cybersecurity protections and will be taking steps to enhance cybersecurity to prevent similar breaches in the future.

Oklahoma Heart Hospital Notifies Patients of Potential ePHI Breach

Oklahoma Heart Hospital is notifying 1,221 patients that some of their protected health information was stored on desktop computers that were stolen in January.

Four desktop computers were stolen from the outpatient clinic at Mercy Hospital in Oklahoma City, OK. Oklahoma Heart Hospital was in the process of relocating those offices when the theft occurred.

The stolen computers were not encrypted so patient information could potentially be accessed by the thieves. Patient information on the computers was present in stored email messages that had been sent between hospital employees and was limited to names, addresses, phone numbers, dates of birth, and clinical information such as blood pressure logs and lab values. Medical records are stored on a secure server and were not exposed.

Oklahoma Heart Hospital has now revised its policies and procedures to prevent similar breaches in the future.

The post 20K Patients of Pasquotank-Camden Emergency Medical Services Impacted by Server Hack appeared first on HIPAA Journal.

Emerson Hospital in Concord, MA, is alerting 6,300 patients that some of their protected health information has been exposed due to a security breach at a third-party vendor in May 2018.

The hospital explained that the breach occurred between May 9 and May 17, 2018 and was an unauthorized disclosure incident. A former employee of MiraMed Global Services, a company that helps the hospital collect payments, was discovered to have sent files containing protected health information to a third-party who was not authorized to receive the information.

The files contained the types of information usually sought by identity thieves, including names, addresses, Social Security numbers, and insurance policy information. Financial information and health information were not compromised.

The employee responsible was fired over the breach and the matter was reported to law enforcement. It is unclear whether the employee responsible has been charged over the theft.

A forensic investigation confirmed that ePHI had been stolen, but a spokesperson for the hospital issued a statement saying, “A detailed forensic investigation showed that the files were of such poor quality that a third-party did not find the data useful.”

Even though the information does not appear to have been misused, as a precaution, all affected patients have been offered identity theft protection services through Experian IdentityWorks for 24 months without charge.

This is the second healthcare institution to report that it has been affected by the breach. Rush System for Health also reported a similar case to OCR on February 28, 2019. Even though names, Social Security numbers, birthdates, and insurance information was also compromised, Rush reported that patients faced a low-risk of fraud since no financial information was compromised. Approximately 45,000 of its patients were affected.

It is not known whether any other healthcare organizations have been affected by the MiraMed breach.

The post Emerson Hospital Alerts Patients to May 2018 Breach at Claims Processing Vendor appeared first on HIPAA Journal.

The Aliso Viejo, CA-based provider of residential care and skilled nursing facilities, Covenant Care, has discovered an unauthorized individual gained access to an employee’s email account and may have viewed or obtained the protected health information of 7,858 patients.

On January 29, 2019, suspicious activity was detected in relation to the employee’s email account. Third-party forensics investigators were called in to help determine the nature and scale of the breach. The investigation revealed the email account was compromised on January 22, 2019. Access remained possible until the account was secured on January 29.

A review of the compromised email account was completed on February 13, 2019 and confirmed that during the time that the account was accessible, emails and email attachments could have been opened. An analysis of the messages revealed they contained patient information.

The information on each patient varied from individual to individual and may have included full name, date of birth, Social Security number, health insurance claim number, medical record number, diagnoses, provider(s) name, treatment location(s), Medicare covered days, Medicare billing amounts, admission and re-admission dates, dates of service, discharge dates, and information related to medical equipment, home health services, outpatient services, and hospice services.

At the time of issuing notifications, no evidence had been uncovered to suggest any patient information was accessed, stolen, or misused; however, out of an abundance of caution, patients were notified and have been offered 12 months of credit monitoring and identity theft restoration services at no charge. Notifications started to be sent on March 6, 2019.

Covenant Care reports that strict security safeguards had been implemented prior to the breach and that further controls will be put in place to increase email security. All technical, administrative, and physical safeguards are being reviewed to identify any further areas where improvements can be made, and employees will be provided with further training on email security and security awareness in general.

The post Covenant Care Email Account Breach Impacts 7,858 Patients appeared first on HIPAA Journal.

Rush University Medical Center is notifying approximately 45,000 patients that their PHI has been exposed as a result of a data incident at a financial services vendor. Rush learned of the incident on January 22, 2019.

An employee of the financial services vendor was discovered to have disclosed a file containing patients’ PHI to an unauthorized third party in May 2018. The types of information in the file varied from patient to patient and may have included names, home addresses, dates of birth, health insurance information, and Social Security numbers. No health information was contained in the file and financial data was not exposed.

Rush conducted an investigation into the breach and while no evidence was found to suggest patient information had been misused, affected patients have been offered membership to the Experian IdentityWorks Credit 3B service to protect against identity theft and fraud as a precaution.

Affected patients have been advised to monitor their financial accounts and explanation of benefits statements from their insurers for any sign of fraudulent activity. All affected patients were notified of the breach by mail on February 25, 2019.

After discovering the breach, Rush suspended its contract with the financial services vendor and the incident has been reported to law enforcement. Steps have now been taken to prevent similar breaches from occurring in the future, including increasing oversight of service vendors, and reviewing and enhancing internal policies, processes, and procedures for contracting third-party firms.

This is the second privacy breach to be reported by Rush in 2019. In February, patients were sent letters to inform them about the retirement of a nurse practitioner at its Epilepsy Center; however, an error in the mailing resulted in 908 letters being sent to incorrect recipients.

The post Rush University Medical Center Notifies 45,000 Patients of PHI Incident appeared first on HIPAA Journal.

Bon Secours St. Francis Health System is notifying patients of a security breach that may have resulted in some of their protected health information (PHI) being viewed/obtained by unauthorized individuals who gained access to the systems of Milestone Family Medicine in Greenville, SC.

Milestone Family Medicine was affiliated with St. Francis Physicians Services (SFPS) until February 24, 2019, and had previously employed physicians at the practice. SFPS learned of a security breach at the practice on January 4, 2019 and took steps to secure systems and prevent further unauthorized access. An investigation was launched and, assisted by a third-party computer forensics firm, SFPS determined that one of the servers that was accessed included the PHI of certain patients.

The attack appears to have targeted EHR systems that were accessible over the Internet. Internet connections providing access to Milestone Family Medicine systems that are not actively being used have been shut down.

The types of information that have been compromised include names, addresses, dates of birth, health insurance information, Social Security numbers, and information related to the medical services provided to patients.

The breach was limited to patients who had previously received medical services at Milestone Family Medicine. Breach notification letters are now being sent to affected individuals and SFPS has offered complimentary credit monitoring and identity theft protection services.

While data theft was possible, no reports have been received to indicate any patients’ PHI has been misused. Affected patients have been advised to monitor their accounts and explanation of benefits statements for indicators of fraudulent activity.

SFPS has said technology management and information security risk oversight are being enhanced to prevent any further breaches of PHI and that the decision to end the affiliation with Milestone Family Medicine was not related to the breach.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights website, so it is currently unclear exactly how many Milestone Family Medicine patients have been affected by the breach.

Patient Records Potentially Accessed During Rocky Boy Health Center Break-in

Patients health records have potentially been compromised during a break-in at the offices of Rocky Boy Health Center in Box Elder, MT.  The health center discovered the break-in on January 16, 2019. Thieves are believed to have gained entry to the property on or around January 14 by forcing the door lock and padlock.

The offices contained X-Ray and dental records dating back to the 1990’s. The records contained PHI such as names, diagnosis codes, and Social Security numbers.

The break-in was reported to law enforcement and all records stored at the offices have been removed and scanned into the electronic medical record system. The physical records have now been shredded.

The records of 971 patients were stored at the offices. All affected individuals have now been notified.

The post St. Francis Physicians Services Notifies Patients of Milestone Family Medicine Data Breach appeared first on HIPAA Journal.