Three email system breaches have been reported in the past few days that have resulted in unauthorized individuals gaining access to email accounts containing protected health information.

Navicent Health Notifies Patients About July 2018 Phishing Attack

Macon, GA-based Navicent Health is notifying certain patients that some of their protected health information has potentially been compromised as a result of an cyberattack on its email system.

Upon discovery of the breach in July 2018, law enforcement was notified and a leading computer forensics firm was hired to investigate the breach.

Navicent Health explained in a substitute breach notice on its website that it only became clear on January 24 that email accounts containing patient information had been breached. No reason was given as to why it took 6 months from the discovery of the breach to determine that patients’ PHI had been compromised.

The types of information potentially accessed by the attackers included names, addresses, dates of birth, and some medical information such as appointment dates and billing information. Some individuals also had their Social Security numbers exposed. Navicent Health was unable to determine whether any patients’ PHI was viewed or downloaded by the attackers.

All patients affected by the incident have now been notified and complimentary identity theft protection services have been offered to all individuals’ whose Social Security number was potentially compromised.

Navicent Health has since been working with multiple cybersecurity firms to improve security and prevent further breaches.

Duluth Human Development Center Discovers Email Account Compromise

When performing a routine analysis of email logs on January 25, the Human Development Center (HDC) in Duluth, MN, discovered the email account of an employee was accessed by an unauthorized individual on two occasions on January 16 and 18, 2019.

An analysis of the compromised account revealed it contained protected health information of clients, including names, dates of birth, internal HDC client numbers, descriptions of the HDC services received, and procedure codes. Clients affected by the breach had received services from HDC between 2011 and 2018.

The probability of information being accessed and misused is believed to be low. Affected individuals have now been notified of the breach.

Frederick Regional Health System Email Breach Impacts Hospice Patients

Frederick Regional Health System in Frederick, MD, has discovered the protected health information of certain hospice patients has potentially been accessed by unauthorized individuals as a result of a phishing attack.

The phishing attack was discovered on January 21, 2019 and unauthorized access to the account was promptly terminated. An analysis of the account revealed emails and attachments contained information such as names, health insurance information, type of health insurance and, for some individuals, Social Security numbers.  Patients affected by the breach had received hospice services from Frederick Regional Health System between June 2017 and January 2019.

No evidence of misuse of PHI has been uncovered but, as a precaution, Frederick Regional Health System is offering eligible patients complimentary credit monitoring and identity theft protection services for 12 months. Security has since been enhanced and further email security training has been provided to employees.

The post PHI Exposed in Three Recent Email Security Incidents appeared first on HIPAA Journal.

Verity Health System patients’ PHI was exposed in a phishing attack in 2016, in two further phishing attacks in November 2018, and the 6-hospital health system has now announced yet another attack occurred in January 2019. The latest phishing incident has impacted 14,894 patients. Across the three incidents, three employees’ email accounts were compromised.

Verity Health System explained in its breach notification letters that no evidence was uncovered to suggest any patients’ protected health information had been accessed by unauthorized individuals. The attacks are believed to have been conducted for use in further phishing attacks on other individuals in the organization, although PHI access could not be ruled out.

The types of information exposed in the latest attack includes names, addresses, contact telephone numbers, dates of birth, diagnoses, treatment information, health insurance policy numbers, subscriber numbers, patient ID numbers, and billing codes. Some of the files attached to emails also included Social Security numbers and driver’s license numbers. Some Verity Health employees also had personal information exposed.

Patients affected by the breach had previously received medical services at Verity Health’s O’Connor Hospital, St. Louise Regional Hospital, St. Francis Medical Center, St. Vincent Medical Center, and Seton Medical Center, including the Seton Coastside campus. Some Verity Medical Foundation patients were also affected.

All patients affected by the breach have now been notified by mail and individuals whose Social Security number or driver’s license number was exposed have been offered complimentary credit monitoring services for 12 months.

In all of the phishing attacks, Verity Health identified the breach quickly and promptly terminated unauthorized access to the compromised accounts. The accounts were then disabled and affected computers were disconnected from the network and all emails that the attackers sent from the compromised accounts were deleted from the email network.

The attacks have prompted Verity Health to deploy a new phishing training module and all employees will be required to complete the training. A new project has also been launched to improve email security, which includes compulsory password resets and disabling unknown URLs.

The post Verity Health System Suffers Third Phishing Breach in 3 Months appeared first on HIPAA Journal.

The Pennsylvania medical device manufacturer and software developer, ZOLL Medical Corporation, has started notifying 277,319 patients about the exposure of some of their personal and medical information.

The information was contained in emails that had been archived using a third-party email archiving solution. During a server migration, archived emails were exposed and could potentially have been accessed by unauthorized individuals.

Upon discovery of the breach, ZOLL initiated an investigation and hired a third-party computer forensics company to determine whether any unauthorized individuals had accessed emails and viewed or downloaded patient information.

The investigation revealed protections had been removed on November 8, 2018 and emails remained accessible until December 28, 2018. No evidence was uncovered to suggest any sensitive information was accessed by unauthorized individuals, but it was not possible to rule out the possibility that personal and medical information had been compromised.

An analysis of the archived emails revealed they contained patient names, addresses, dates of birth and a limited amount of medical information. A small percentage of affected patients also had their Social Security number exposed.

As a precaution against identity theft and fraud, all patients affected by the breach have been offered complimentary credit monitoring and identity theft protection services for 12 months.

ZOLL has confirmed that the email archiving company has secured all exposed emails and has implemented measures to prevent further data breaches. ZOLL has said it has conducted a review of its own processes for managing third-party vendors and has updated policies and procedures to prevent any further data breaches.

The post Medical Device Manufacturer Notifies 277,319 Patients About PHI Exposure appeared first on HIPAA Journal.

Another unsecured healthcare database has been discovered which contains an estimated 37,000 records.

The discovery was made on March 1, 2019 by security researcher Jeremiah Fowler. A brief analysis of the database appeared to show the records belonged to the New Jersey healthcare provider, Home Health Radiology Services LLC. The database contained highly sensitive patient information such as names, addresses, phone numbers, and dates of birth along with medical notes, diagnoses, treatment information, insurance information, and in some cases, Social Security numbers.

In a recent blog post on securitydiscovery.com, Fowler explained that 37,000 case files were found along with 1,540 doctor’s information records, chat logs, emails, support tickets, and many other sensitive files.

The records were mostly contained in an Elastic database which could be accessed over the internet by anyone without the need for any authentication.

The unsecured database was reported to Home Health Radiology Services, which promptly secured the database to prevent any further unauthorized access. It is currently unclear how long the database was accessible over the internet and whether anyone other than Fowler viewed the data.

The incident is one of many similar breaches that have occurred as a result of protections being removed from servers and databases. Also this week, a fax server used by Sacramento, CA-based medical software provider Meditab Software Inc., was discovered to have had protections removed which allowed healthcare faxes to be viewed in real time over the internet. More than 6 million records were reportedly housed on the server.

In February, almost 1 million records of UW medicine were discovered to have been exposed over the internet due to a database misconfiguration.

These incidents highlight the importance of putting policies and procedures in place to ensure that all servers and databases used storing patient health information are checked to ensure they have protections in place to prevent unauthorized data access, especially after any software upgrades have been performed or patches have been applied.

These are not just isolated incidents. In late 2018, a study by the enterprise threat management platform provider Intsights suggested as many as 30% of healthcare databases have been exposed online.

The post Database of New Jersey Healthcare Provider Found to be Leaking Patient Data appeared first on HIPAA Journal.