993 Ohioans who receive benefits from Medicaid or the Ohio Department of Job and Family Services (ODJFS) are being notified that some of their protected health information has been disclosed to unauthorized individuals as a result of a computer error.

Three separate incidents were identified. On February 16, 2019, a computer error resulted in a limited amount of protected health information (PHI) of 250 users of the Ohio Benefits Self-Service Portal to appear in another user’s account. The error was identified and corrected the same day.

Two further incidents occurred on March 20, 2019. A computer error caused information entered into the Ohio Benefits portal to be saved to incorrect accounts. The computer error has been temporarily fixed and a permanent solution is being developed to prevent any recurrences. As many as 100 individuals were affected.

608 members of ODJFS, 34 recipients of Medicaid benefits, and one individual who received both types of benefits, had some of their PHI mailed to 5 different people as a result of a computer error. The computer error was corrected on March 22, 2019.

In all cases, the privacy breach was limited to names, contain information, dates of birth, case numbers, and claim numbers stored in the Ohio Benefits System. Affected individuals have been offered identity theft protection services for 12 months at no cost as a precaution.

840 University Hospitals Rainbow Babies & Children’s Hospital Patients Notified of Impermissible PHI Disclosure

University Hospitals Rainbow Babies & Children’s Hospital in Cleveland, OH, has discovered the PHI of 840 patients has been accidentally disclosed due to an error made by one of its employees.

The employee sent an email to a group of patients that contained a limited amount of personally identifiable information. The email was sent on February 28, and while information about patients was not detailed in the message, it implied that all individuals to whom the email had been sent suffer from the same medical condition.

The employee should have added the message recipients to the BCC field but made an error and included their emails in the ‘to’ field. As a result, the email addresses of all recipients of the email were visible to other members.

Al individuals affected have been notified of the privacy breach and the hospital has sanctioned the employee “in a manner deemed appropriate for the violation.” The employee has been reeducated on proper mail procedures and further education on patient privacy and HIPAA requirements will be provided to other staff members.

The post 1,600 Ohio Patients Notified of Impermissible PHI Disclosure appeared first on HIPAA Journal.

Main Line Endoscopy Centers, a network of outpatient endoscopy facilities in the Malvern, Bala Cynwyd, and Media regions of Pennsylvania, has discovered an unauthorized individual has gained access to the email account of one of its employees following a response to a phishing email.

It is not clear exactly when the account was breached, but it was discovered by Main Line on January 30, 2019.

A leading computer forensics firm was retained to assist with the investigation and determine which, if any, emails in the account had been opened and whether any patient information had been compromised. The investigation confirmed that the attackers potentially gained access to the protected health information of certain patients, which included names, dates of birth, and limited clinical information. Some patients also had their Social Security number, driver’s license number, and/or health insurance information exposed.

All patients affected by the breach were sent breach notification letters on March 29, 2019 and individuals whose Social Security number or driver’s license number were exposed have been offered complimentary identity theft protection services for 12 months at no cost.

As a precaution, all individuals affected by the breach have been advised to monitor their accounts, explanation of benefits statements, and credit reports closely for any sign of fraudulent use of their information.

To improve security and prevent further breaches, Main Line has provided further training to all staff to improve email security awareness and alert them to the threat from phishing. Multi-factor authentication has been implemented to prevent accounts from being accessed in the event that further credentials are compromised along with other security measures.

The breach has been reported to the Department of Health and Human Services’ Office for Civil Rights. The OCR breach portal indicates 14,305 patients were affected by the breach.

The post Phishing Attack Impacts 14,305 Patients of Main Line Endoscopy Centers appeared first on HIPAA Journal.

DePaul, a provider of assisted living facilities and healthcare services in New York, North Carolina, and South Carolina, is alerting certain members of its behavioral health program that some of their protected health information has been exposed as a result of a phishing attack.

The breach was discovered on February 1, 2019 and the account was immediately secured. The investigation into the breach confirmed that a single email account had been compromised as a result of an employee being fooled by a phishing cam. The email account contained approximately 41,000 emails, which needed to be checked to determine whether they contained any sensitive information.

The vast majority of the emails in the account did not contain any significant medical or psychiatric information; however, a small number of emails contained information such as first and last names, dates of birth, and/or Social Security numbers.

The aim of the attack appeared to be to use the compromised email account to send further phishing emails. No evidence was found to suggest the attacker viewed or copied emails containing sensitive information.

Individuals whose Social Security number was potentially compromised have been offered complimentary credit monitoring services for one year.  DePaul will be providing staff with additional training to improve resilience to phishing attacks.

The breach has yet to be uploaded to the HHS’ Office for Civil Rights breach portal, so it is currently unclear exactly how many individuals have been affected by the breach.

Southern Hills Eye Care Ransomware Attack Reported

Southern Hills Eye Care in Sioux City, IA, has experienced a security incident which may have resulted in the exposure of patients’ protected health information.

On January 15, 2019, ransomware was installed on a server in its Sioux City offices and files were encrypted. A forensic investigation confirmed that an unauthorized individual had gained access to the server and may have viewed files containing patients’ protected health information. The types of information in the files included names, addresses, dates of birth, phone numbers, health information, health insurance information, and the Social Security numbers of Medicare patients.

While data access was possible, no evidence was uncovered to suggest any patient information was accessed by unauthorized individuals. Additional security controls have now been implemented to prevent any future breaches of this nature.

The breach has yet to appear on the OCR breach portal so it is currently unclear how many patients have been affected. Notifications were sent to affected patients on March 15, 2019.

The post Security Breaches Reported by DePaul and Southern Hills Eye Care appeared first on HIPAA Journal.

Burrell Behavioral Health is notifying 67,493 patients that their medical records have been accidentally exposed as a result of an error at an unnamed business associate in August 2018.

The error was introduced into the business associate’s internet-facing portal, which resulted in images of Burrell Behavioral Health patients’ protected health information being exposed. The images contained information such as: Name, address, telephone number, birth date, gender, dates of service, types of service provided, health insurance information, driver’s license number, and Social Security number.

The exposure of patient data was brought to the attention of Burrell Behavioral Health on January 30, 2019. Burrell Behavioral Health notified its business associate about the data exposure and the server was immediately secured.

A forensic investigation was conducted to determine which information had been exposed and whether it was subjected to unauthorized access. The investigation revealed patient information was uploaded to the server in August 2018. No evidence was uncovered to suggest that anyone had accessed the information and neither had automated website crawlers and scanners accessed the information. The format of the images was such that it would not have been possible for the information to be accessed through general web browsing or internet searches.

Consequently, the investigators concluded that there is a “very low probability” of unauthorized data access, although, out of an abundance of caution, all patients whose Social Security number has been compromised as a result of the breach have been offered complimentary identity theft monitoring and protection services.

Burrell Behavioral Health has taken steps to prevent any further breaches of this nature from occurring and is working with its business associates to ensure they have adequate technical and administrative safeguards in place to ensure the confidentiality of patient information.

The post 67,493 Patients of Burrell Behavioral Health Impacted by Business Associate Breach appeared first on HIPAA Journal.

The Centerville, Ohio dental insurance carrier, Superior Dental Care, has discovered an unauthorized individual has gained access to an employee’s email account and potentially viewed the protected health information of certain members.

The email account breach was detected on January 23, 2019 following the identification of suspicious activity within the employee’s email account. The password for the account was immediately changed and further unauthorized access was prevented.

A third-party computer forensics firm was called in to assist with the investigation and determine the nature and scope of the breach.

On February 11, 2019, Superior Dental Care learned that the account had been accessed by an unidentified third party and unauthorized access to the email account was first gained on December 21, 2018.

The email account contained information such as names, addresses, Social Security numbers, medical information, and payment information related to dental services received.

All individuals affected by the breach have now been notified by mail and the breach has been reported to appropriate authorities.

Processes have already been implemented to strengthen system security and Superior Dental Care will continue to work with third-party security experts to better protect members’ personal information.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal, so it is unclear exactly how many members have been affected by the breach.

L.A. Care Health Plan Alerts Members to PHI Exposure Due to Mailing Error

L.A. Care Health Plan is alerting some of its members to a privacy breach that saw members’ protected health information accidentally disclosed to other members.

A system error resulted in L.A. Care member ID cards being mismatched and sent to incorrect plan members. In some cases, members received their correct ID card along with the ID cards of other members in the same envelope.

The system error occurred on June 1, 2018 and affected ID card mailings up until January 30, 2019.

The protected health information that was accidentally disclosed was limited to name, phone number, member ID number, medical group name, PCP/Clinic name, and health plan name.

L.A. Care Health Plan has since updated its processes and procedures to reduce the risk of a similar incident occurring in the future.

The post Superior Dental Care Patients Informed of PHI Exposure Due to Email Account Breach appeared first on HIPAA Journal.