Pawnee County Memorial Hospital in Pawnee City, Nebraska, is alerting 7,038 patients that some of their protected health information has potentially been accessed by a hacker.

On November 29, 2018, the hospital learned that malware had been installed which allowed an unauthorized individual to gain access to its email system.

Malware was injected into the hospital’s email system when an employee opened a malicious email attachment. According to Pawnee County Memorial Hospital’s substitute breach notice, the email appeared to have been sent from a trusted source and the email attachment seemed genuine.

Assisted by a third-party computer forensics expert, the hospital determined that the email attachment had been opened on November 16, 2018. The hacker was able to access employees’ email accounts from November 16 to November 24.

The compromised email accounts contained a range of business reports, clinical reports, clinical summaries, and other internal documents. Those documents contained patients’ full names along with one or more of the following data elements: Date of birth, address, diagnosis, lab test results, medical record number, insurance information, state ID number, driver’s license number and, for a limited number of patients, Social Security number.

While PHI access was possible, it is unclear whether the hacker viewed or obtained any patient information. The hospital believes the attack was financially motivated and was not conducted with the aim of stealing patient information.

In response to the breach, the hospital reset all passwords on employee email accounts and additional technology safeguards are being implemented to improve email security.

The hospital has sent breach notification letters to all patients whose PHI was exposed and has offered complimentary enrollment in the MyTrueIdentity online credit monitoring service for 12 months.

The post 7,000 Patients Notified About Pawnee County Memorial Hospital Malware Attack appeared first on HIPAA Journal.

EyeSouth Partners has announced that a hacker has gained access to an employee’s email account and has potentially viewed/obtained the electronic protected health information (ePHI) of as many as 24,000 patients.

EyeSouth Partners is a business associate of Georgia Eye Associates, South Georgia Eye Partners, Cobb Eye Center, and Georgia Ophthalmology Associates. On October 25, 2018, EyeSouth Partners became aware that an unauthorized individual had gained access to the email account of one of its employees.

Prompt action was taken to secure the email account and assess the security of its systems. Procedures were also implemented to enhance information security safeguards to prevent any further email account breaches.

The breach investigation revealed the hacker first gained access to the email account on September 11, 2018. Access remained possible until October 25.

Third-party computer forensics experts were hired to assist with the investigation and determine which patients had had their ePHI exposed. On December 19, 2018, EyeSouth Partners was informed that the hacker had potentially accessed emails that contained the ePHI of patients of Georgia Eye Associates.

The information contained in emails and email attachments differed from patient to patient but may have included names, addresses, contact telephone numbers, email addresses, insurance provider names, type of insurance carrier, payment histories, account balances, summaries of charges, summaries of services and procedures, and internal patient ID numbers. A small number of patients also had their Social Security number exposed.

All patients affected by the breach have now been notified by mail and offered complimentary credit monitoring services.

The post EyeSouth Partners Email Account Breach Impacts 24,000 Patients of Georgia Eye Associates appeared first on HIPAA Journal.

EyeSouth Partners has announced that a hacker has gained access to an employee’s email account and has potentially viewed/obtained the electronic protected health information (ePHI) of as many as 24,000 patients.

EyeSouth Partners is a business associate of Georgia Eye Associates, South Georgia Eye Partners, Cobb Eye Center, and Georgia Ophthalmology Associates. On October 25, 2018, EyeSouth Partners became aware that an unauthorized individual had gained access to the email account of one of its employees.

Prompt action was taken to secure the email account and assess the security of its systems. Procedures were also implemented to enhance information security safeguards to prevent any further email account breaches.

The breach investigation revealed the hacker first gained access to the email account on September 11, 2018. Access remained possible until October 25.

Third-party computer forensics experts were hired to assist with the investigation and determine which patients had had their ePHI exposed. On December 19, 2018, EyeSouth Partners was informed that the hacker had potentially accessed emails that contained the ePHI of patients of Georgia Eye Associates.

The information contained in emails and email attachments differed from patient to patient but may have included names, addresses, contact telephone numbers, email addresses, insurance provider names, type of insurance carrier, payment histories, account balances, summaries of charges, summaries of services and procedures, and internal patient ID numbers. A small number of patients also had their Social Security number exposed.

All patients affected by the breach have now been notified by mail and offered complimentary credit monitoring services.

The post EyeSouth Partners Email Account Breach Impacts 24,000 Patients of Georgia Eye Associates appeared first on HIPAA Journal.

Malware has been installed on the network of Reproductive Medicine and Infertility Associates: A Woodbury, MN, infertility clinic.

While no evidence was uncovered to suggest any patient information was accessed or exfiltrated by the malware, the possibility of a data breach could not be ruled out.

The malware attack was detected by the clinic on December 5, 2018 and a third-party computer forensics firm was hired to investigate and clean the malware from its systems. While the malware was successfully removed, it was not possible to determine exactly how it was installed on the network.

Information stored on systems potentially accessible by the malware included names, dates of birth, addresses, treatment information, health insurance information, and donors’ Social Security numbers.

All individuals whose PHI was exposed were notified about the incident on February 1, 2019. As a precaution against fraud, all individuals affected by the breach have been offered complimentary identity theft monitoring services.

Anti-malware defenses have now been improved, which include an additional firewall, extra layers of security, and further training for employees on data security.

Server Stolen from Waco Dental Clinic

Stonehaven Dental, an operator of two dental practices in Waco and Harker Heights, TX, has announced that thieves broke into its Waco clinic and stole a computer server that contained patient information.

All data on the server had been backed up via a cloud storage service and could be restored. The server was protected with two layers of password-security, but patient data was not encrypted.

The server contained patients’ names, telephone numbers, addresses, dates of birth, medical records, medical record numbers, health insurance information, and for some patients, Social Security and Driver’s license numbers.

While data access is unlikely, it is possible that the passwords could be cracked. Consequently, the decision was taken to offer affected patients complimentary identity theft protection services.

Affected patients were notified about the incident on January 22, 2019. The HHS’ Office for Civil Rights has also been informed. The breach summary on the OCR website indicates 6,289 patients’ information was stored on the stolen server.

Physical security at Stonehaven Dental offices has now been strengthened and all devices containing patient information are now encrypted.

The post Malware Attack Reported by Minnesota Infertility Clinic appeared first on HIPAA Journal.

Dr. DeLuca Dr. Marciano & Associates, P.C., a primary eye care clinic in Prospect, CT, has experienced a ransomware attack that has resulted in the encryption of files containing patients’ protected health information.

The attack occurred on November 29, 2018. Prompt action was taken to shut down the network to prevent the spread of the infection, but it was not possible to stop the encryption of files on two servers used to store patient-related files. A ransom demand was received but no payment was made. The encrypted files were successfully restored from backups.

An investigation of the breach revealed that the two servers affected by the attack contained patient files that included information such as patient names, Social Security numbers, and some treatment information.

Dr. DeLuca Dr. Marciano & Associates has taken steps to prevent further cyberattacks, which include closing remote access to the network, implementing technical solutions to protect against ransomware, and enhancing its anti-virus software.

While there is no indication that patient information was accessed or stolen, all individuals whose protected health information was potentially compromised have been notified by mail and, out of an abundance of caution, offered complimentary credit monitoring and identity theft protection services.

The ransomware attack has been reported to all appropriate authorities. The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights (OCR) indicates 23,578 patients have been affected by the breach.

Patients’ PHI Potentially Accessed in Chaplaincy Health Care Phishing Attack

Chaplaincy Health Care, a not-for-profit provider of hospice, behavioral health, palliative care, and chaplain services in the tri-cities area of southeast Washington, has discovered an unauthorized individual has gained access to the email account of an employee and potentially viewed patients’ protected health information.

The breach was detected on November 20, 2018 – The same day that the account was breached. Assisted by a third-party computer forensics firm, Chaplaincy Health Care determined that an unknown individual gained access to a single email account for a period of around 4 hours.

Emails in the account contained patients’ names, home addresses, dates of birth, medical record numbers, prescription information, dates of service, and the last four digits of Social Security numbers.

Breach notification letters were sent to affected individuals on January 3, 2019. Complimentary credit monitoring and identity theft protection services have been offered to breach victims.

The breach has prompted Chaplaincy Health Care to provide further training on email security to employees. 2-factor authentication has also been implemented to protect against unauthorized account access.

The breach report submitted to OCR indicates the PHI of 1,086 patients was potentially accessed.

The post 23,500 Patients Impacted by Connecticut Eye Clinic Ransomware Attack appeared first on HIPAA Journal.

Valley Professionals Community Health Center, a network of seven healthcare centers in Indiana, has experienced a phishing attack that has resulted an employee’s email account being accessed by an unauthorized individual.

Phishing attacks often involve the impersonation of companies. In this case, the attacker impersonated a healthcare organization that had previously worked with Valley Professionals Community Health Center. The supposed sender of the email was known to staff at the health center and the email appeared genuine.

On November 27, 2018, Valley Professionals Community Health Center detected suspicious activity relating to the employee’s email account. Prompt action was taken to secure the account and an investigation was launched to determine the cause of the activity. Assistance was provided by a third-party computer forensics company, which determined that the account had been accessed by an unauthorized individual between October 26 and November 27, 2018.

The emails in the account contained information such as patient names, addresses, dates of birth, Social Security numbers, medical record numbers, patient ID numbers, diagnoses, procedure information, treatment information, information relating to payment for medical services, and provider information. A small number of patients also had their bank account number, routing information, and/or health insurance information exposed.

Since it was not possible to determine which, if any, emails in the account had been accessed by the attacker, the decision was taken to send notification letters to all individuals whose protected health information was contained in the account. Approximately 12,000 patients have been sent notification letters. All patients affected by the incident have been offered complimentary credit monitoring services.

The breach has prompted Valley Professionals Community Health Center to implement additional technical safeguard to prevent further successful phishing attacks and additional training and education has been provided to employees.

Sunflower State Health Plan Alerts 1,625 Members of Impermissible PHI Disclosure

Sunflower Health Plan in Kansas is alerting 1,625 plan members that some of their protected health information has been impermissibly disclosed to other individuals.

On November 26, 2018, Sunflower Health Plan mailed ID cards and Welcome Packlets to 1,625 plan members; however, an error with the mailing resulted in the letters being sent to incorrect addresses.  The letters contained patients’ full names and Medicaid ID numbers.

The error was detected on December 3, 2018 and replacement ID cards and Welcome Packlets were mailed to the correct addresses.

Sunflower Health Plan has now changed its mailing processes to prevent further mailing errors and PHI exposures. No reports of improper use of PHI have been received.

The post 12,000 Patients Impacted by Valley Professionals Community Health Center Phishing Attack appeared first on HIPAA Journal.