Midwest, has announced that an unauthorized individual has gained access to the email account of an employee.

Valley Hope Association became aware of a potential account breach on October 10, 2018, when unusual account activity was detected. Prompt action was taken to prevent further account access and a third-party computer forensics firm was hired to determine the nature and scope of the breach.

The investigation confirmed on November 23, 2018, that an unauthorized individual had accessed a single email account between October 9-10, 2018, and potentially viewed emails and attachments containing patients’ protected health information. After a thorough review of all emails and email attachments, the forensics firm confirmed that certain patients’ PHI may have been accessed.

The types of information contained in the emails varied from patient to patient and may have included one or more of the following data elements: Name, address, date of birth, Social Security number, medication and prescription information, claims and billing information, medical record number, health insurance information, and physician’s name. No diagnosis or treatment information was contained in the emails.

Following the confirmation of exposed information, Valley Hope Association has been attempting to identify current contact information for all affected individuals and each will be notified and told about the exact information that has potentially been compromised. While data access/theft is a possibility, no reports have been received to suggest any patient information has been misused.

As a precaution against identity theft and fraud, patients impacted by the breach have been offered 12 months of complimentary identity theft monitoring services through Kroll.

Valley Hope Association has been reviewing and revising its policies and procedures to further protect the security and confidentiality of information on its systems and additional safeguards will be implemented as appropriate.

The breach has been reported to law enforcement, state regulators, credit monitoring bureaus, and the Department of Health and Human Services Office’ for Civil Rights.

The incident has yet to appear on the OCR breach portal, so it is currently unclear exactly how many patients have been impacted by the breach.

The post Valley Hope Association Notifies Patients of Email Account Breach appeared first on HIPAA Journal.

Lebanon VA Medical Center in Pennsylvania has discovered the protected health information of hundreds of elderly patients has been impermissibly disclosed to a family member of a veteran.

In November 2018, a member of staff at Lebanon VA Medical Center emailed a document to a family member of a veteran who was searching for nursing home facilities. The list should have contained nursing home facilities that work with the Department of Veteran Affairs; however, a historical list of residents of nursing homes was sent in error.

The list contained veterans’ names, abbreviated Social Security numbers, the nursing home where the veteran had been admitted, diagnoses, and service-connection disability rating percentages.

“Lebanon VA Medical Center and our employees take our responsibility to protect patient information very seriously,” explained Lebanon VA privacy officer Tonya Hromco. “Along with assistance from national offices, we immediately investigated this inadvertent, unauthorized release of information which occurred in late November.”

The incident was an isolated error and steps have now been taken to reduce the potential for further mistakes. Additional controls have been implemented in the section where the error occurred and throughout its facility. Files containing historic information have now been encrypted and restrictions have been placed on the number of individuals with access to those files. Technical controls have also been implemented that prevent members of the department from sending email attachments externally.

A press release issued by Lebanon VA Medical Center says the PHI of 993 individuals was impermissibly disclosed. The breach report on the HHS’ Office for Civil Rights’ breach portal suggests the breach could have impacted up to 1,002 individuals.

Individuals affected by the privacy breach and family members of deceased patients have recently been mailed breach notification letters.

The post PHI of Almost 1,000 Lebanon VA Medical Center Patients Impermissibly Disclosed appeared first on HIPAA Journal.

Centerstone Insurance and Financial Services, operating as BenefitMall, has started notifying more than 111,000 individuals that some of their protected health information has been exposed, and potentially stolen, in a recent email security incident.

Dallas, TX-based BenefitMail is a provider of employee benefits, payroll, HR, and employer services and employs more than 20,000 advisors, brokers, and CPAs across the country. The company is a business associate of several HIPAA-covered entities.

On October 11, 2018, the company became aware that email accounts used by its employees had been accessed by an unauthorized individual. A third-party computer forensics firm was retained and an internal investigation was conducted to assess the nature and scope of the breach.

The investigation revealed the first email accounts had been compromised in June 2018 and further email accounts were breached and accessed up to October 11 when the attack was detected. Prompt action was taken to secure the compromised email accounts and prevent further remote email account access. The email accounts were compromised as a result of employees falling for phishing scams.

An analysis of the compromised email accounts revealed many emails in those accounts contained the personal information of individuals related to the services provided. The information exposed and potentially stolen was limited to names, addresses, social security numbers, dates of birth, bank account numbers, and information relating to payment of insurance premiums.

The security breach has prompted BenefitMail to review its email security controls, which have now been augmented to provide greater protection against phishing attacks. Two-factor authentication has now been implemented on its email system and employees have been provided with further training to improve awareness of phishing scams and how to guard against them. Further security awareness and phishing training will be provided to employees on an ongoing basis.

The security breach has been reported to law enforcement and BenefitMail will continue to assist with their investigation and will work closely with the insurance providers whose members were affected by the breach.. The Department of Health and Human Services’ Office for Civil Rights (OCR) has been notified. The breach report submitted to OCR indicates 111,589 individuals have been affected by the breach.

The post 111K Individuals Notified of 4-Month Email Account Compromise appeared first on HIPAA Journal.

Memphis, MI-based Sacred Heart Rehabilitation Center, a provider of substance abuse treatment and care services for patients diagnosed with HIV/AIDS, has discovered an unauthorized individual has gained access to the email account of an employee following a response to a phishing email.

The email account was breached between April 5 and April 7, 2018. It is unclear when the phishing attack was detected by the rehabilitation center, but the investigation into the breach concluded in November and revealed the account contained some patients’ protected health information. Individuals whose PHI was exposed were sent notification letters on January 9, 2018.

The types of information contained in the compromised account included patients’ names, home addresses, diagnoses, treatment information, health insurance information, and Social Security numbers.

The number of patients affected by the breach has not been publicly disclosed at this point and the breach has not yet been listed on the Department of Health and Human Services’ Office for Civil Rights breach portal. Sacred Heart Rehabilitation Center has said not all patients were affected.

All patients whose PHI was exposed as a result of the attack have been offered complimentary credit monitoring and identity theft protection services for 12 months and have been advised to monitor their financial accounts and explanation of benefits statements for signs of misuse of their PHI. To date, no reports of PHI misuse have been received by Sacred Heart Rehabilitation Center.

To reduce the risk of further successful phishing attacks, additional security measures have been implemented and employees have received further security awareness training.

It has not been a great end to the year for healthcare organizations in Michigan. Blue Cross Blue Shield of Michigan announced in December that two data breaches had occurred, which together impacted more than 16,000 individuals. A phishing attack was also reported by Kent County Community Mental Health Authority, which affected 2,200 patients.

The post Sacred Heart Rehabilitation Center Notifies Patients of Phishing Incident appeared first on HIPAA Journal.

An unencrypted laptop computer has been stolen from Ben-Ora, Hansen, Vanesian Imaging Ltd., dba Solis Mammography.

Solis Mammography learned on October 17, 2018 that the laptop had been stolen from its Phoenix, AZ clinic and reported the theft to law enforcement. To date the device has not been recovered. Attempts were made to reconstruct the data stored assisted by a leading computer forensics firm.

While the investigation confirmed that some patients’ protected health information had been downloaded to the device, it was not possible to ascertain the exact information that had been exposed.

Solis Mammography believes information such as patients names, birth dates, health insurance information, lab test results, medical images, and other information could have been stored on the device and have potentially been accessed by the individual in possession of the computer. Solis Mammography does not believe any financial information was downloaded onto the laptop.

Solis Mammography has taken steps to further secure patient information including strengthening access controls and reviewing and updating policies and procedures concerning the secure disposal of patient information.

No reports have been received to suggest any information stored on the device has been accessed and misused, although patients have been advised to monitor their statements from healthcare providers and insurers for services that have not been received.

Solis Mammography has reported the theft to the Department of Health and Human Services’ Office for Civil Rights on December 16, 2018. The breach report suggests up to 500 patients’ PHI may have been stored on the device.

The post Solis Mammography Notifies 500 Patients of PHI Exposure appeared first on HIPAA Journal.

Starting on October 28, 2018, Kent County Community Mental Health Authority, dba Network180, experienced a targeted phishing attack.

As is common in advanced phishing attacks, the emails appeared to have been sent from a trusted source. Between November 2 and November 13, three employees responded to the emails and disclosed their credentials, which allowed their encrypted email accounts to be accessed by an unauthorized individual.

At least one of the compromised email accounts contained the protected health information (PHI) of patients. A wide range of PHI was included in the emails stored in the compromised account.

The types of information that could potentially have been accessed by the attacker varied from patient to patient, but may have included names, addresses, dates of birth, Medicaid/Medicare ID numbers, Internal ID numbers, Waiver Support Application (WSA) numbers, names of healthcare providers, schools that were attended, names of relatives, ethnicity/race, and the Social Security numbers of 20 patients. No financial information is believed to have been exposed.

The internal investigation into the attack uncovered no evidence to suggest any PHI was accessed, viewed, or misused.

Network180 had security measures in place to keep the PHI of patients private and confidential but those controls were bypassed on this occasion. The internal investigation, conducted by the IT department, HIPAA Privacy Officer, HIPAA Security Officer, and Network180’s HIPAA legal counsel, concluded that the attack was not preventable.

All passwords were reset and unauthorized access is no longer possible. Additional safeguards have now been implemented to improve email security.

While PHI access/theft is not suspected, out of an abundance of caution, all affected patients have been offered at least 12 months of complimentary identity theft protection services through Experian.

The post Phishing Attack Impacts 2,200 Kent County Community Mental Health Authority Patients appeared first on HIPAA Journal.