BJC HealthCare, one of the largest not-for-profit healthcare networks in the United States, has discovered hackers have gained access to the website hosting its patient portal and have uploaded malware that potentially intercepted credit/debit card numbers as they were entered in the payment portal.

The breach was discovered on November 19, 2018. The internal investigation revealed malware had been uploaded to the payment portal on October 25, 2018 and payment information may have been intercepted until November 8, 2018. During that time, 5,850 credit/debit card payments had been processed.

BJC HealthCare reports that no Social Security numbers or medical information was compromised. The breach was limited to patients’ names, addresses, and dates of birth, along with the name, billing address, and credit card information or bank information of the person making the payment.

While the above information was potentially intercepted, BJC HealthCare has not received any reports to suggest the attackers obtained and misused patients’ or payors’ data. However, all affected individuals have been advised to carefully monitor their bank and credit card statements for any unauthorized payments.

BJC Healthcare has now implemented additional security controls on its payment portal that provide enhanced protection against malware. All affected patients have been notified of the breach by mail and the incident has been reported to appropriate authorities.

CCRM Dallas-Fort Worth Notifies 1,117 Patients of Email Account Breach

The email account of a nurse at CCRM Dallas Fort Worth has been accessed by an unauthorized individual. The email account breach was detected on October 4, 2018, following reports from patients who had received spam emails from the nurse’s account.

CCRM Dallas-Fort Worth immediately deactivated the email account and contacted its IT vendor who launched an investigation. It was confirmed that the account had been accessed and emails containing patient’s protected health information may have been viewed by the attacker.

The email account contained a range of patient information including names, addresses, email addresses, health insurance information, health information and medical histories, and a limited number of Social Security numbers and driver’s license numbers.

Aside from patients’ email addresses being used by the attacker, no other evidence of PHI misuse has been discovered.

The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights. The breach portal entry indicates 1,117 patients have been affected by the breach. Patients affected by the breach were notified by mail on December 3, 2018.

The post Credit Card Numbers Exposed in BJC Healthcare Breach appeared first on HIPAA Journal.

Approximately 32,000 patients of the University of Vermont Health Network’s Elizabethtown Community Hospital are being notified that some of their protected health information (PHI) has been exposed as a result of email account breach.

On October 18, 2018, Elizabethtown Community Hospital discovered an unauthorized individual had gained access to an employee’s email account. The password for the compromised email account was immediately changed and a leading forensic security firm was retained to conduct an investigation into the breach. The investigation, which lasted 60 days, confirmed that a single email account was compromised on October 9, 2018.

The hospital’s information technology systems were not accessed and medical records remained secure at all times. An analysis of the breached email account revealed it contained the PHI of around 32,000 patients. The types of information that were exposed differed from patient to patient and may have included names, addresses, dates of birth, primary information such as medical record numbers, dates of service, summaries of services provided, and limited medical information. The Social Security numbers of 1,200 patients were also exposed.

During the nine days that the account was accessible it is possible that the PHI of patients was viewed or copied, although no evidence of data theft was found. Elizabethtown Community Hospital is unaware of any misuse of patient information.

Elizabethtown Community Hospital decided to notify 32,000 patients out of an abundance of caution. The investigation is ongoing, and the breach may be found to have affected fewer patients. Free credit monitoring and identity theft protection services have been offered to all patients whose social security number was exposed.

Elizabethtown Community Hospital has now enhanced the security of its email system and further training has been provided to employees in relation to protecting patient information.

The post Up to 32,000 Patients Impacted by Elizabethtown Community Hospital Email Account Breach appeared first on HIPAA Journal.

Contra Costa Health Plan (CCHP) has started notifying certain patients that some of their protected health information may have been viewed by an unauthorized individual.

That individual was a contractor who won a series of contracts related to utilization management. The contractor first started working with CCHP on December 1, 2018, and was given access to systems containing health plan records to complete her contracted duties.

On May 22, 2018, CCHP learned that the contractor had falsified her identity in order to win the contracts. Upon discovery of the fraud, CCHP terminated the contract and blocked access to its systems. A full audit of the activities of the contractor was conducted to determine what systems had been accessed and whether plan members’ data had been viewed.

The audit revealed that the contractor had accessed plan members’ health plan records while performing her utilization management duties, although no evidence was uncovered to suggest any of the information contained in those records has been further disclosed by the contractor or used inappropriately.

The types of information potentially viewed included names, addresses, phone numbers, dates of birth, medical information, prescription information, and Social Security numbers.

The California’s Department of Health Care Services was notified about the incident and advised CCHP to issue notifications to all plan members whose records had been accessed. Those individuals have been offered complimentary credit monitoring, identity theft protection, and identity restoration services out of an abundance of caution.

Ramsey County Social Services Notifies Patients of Phishing Breach

Ramsey County Social Services in St. Paul, MN, experienced a phishing attack on August 9, 2018 that resulted in the email accounts of 28 employees being accessed by unauthorized individuals.

After gaining access to the email accounts, the attackers attempted to redirect employees’ paychecks. Prompt action was taken to block the attack and secure the accounts and a data security firm was hired to conduct a thorough investigation of the breach.

On October 12, 2018, the data security firm notified Ramsey County Social Services that the hackers had potentially viewed emails in the account that contained the protected health information of approximately 500 patients, most of whom had used the agency’s chemical and mental health services.

The types of information contained in the accounts included names, addresses, dates of birth, Social Security numbers, and a limited amount of medical information. Patients affected by the breach were notified in early December. No reports have been received to suggest any information in the email accounts has been misused.

To better protect employee email accounts, a tool has been implemented to ensure employees set strong passwords and multi-factor authentication has been implemented to prevent accounts from being accessed from unknown locations and devices. New security software has also been implemented that offers enhanced monitoring and auditing capabilities and employees have been provided with further training.

The post PHI Accessed by Contra Costa Health Plan Contractor Who Falsified Identity to Win Contracts appeared first on HIPAA Journal.

Mind & Motion Developmental Centers of Georgia has announced that hackers have succeeded in installing ransomware and malware on a server, which has potentially allowed them to gain access to patients’ protected health information.

The ransomware was downloaded and executed on a server housing Mind & Motion medical records. The types of data that were potentially compromised includes names, addresses, birth dates, patients’ gender, medical histories, medical diagnoses, health insurance information, and Social Security numbers. It is also possible that medical records were compromised as a result of the attack.

Mind & Motion discovered the ransomware attack on September 30, 2018. An IT vendor, TeamLogic IT, was retained to investigate the breach, determine how the attack occurred, and help recover data that had been rendered inaccessible by the ransomware.

In addition to the ransomware infection, TeamLogic IT discovered an inactive keylogger and a spam emailer on the server. All malware was successfully removed and associated accounts were deleted. TeamLogic IT did not uncover evidence to suggest any of the installed malware had been used to access patient financial information or its scheduling and electronic billing systems.

Since the attack was discovered, Mind & Motion has not received any reports from patients to suggest that any of their PHI has been stolen and misused. The attack is believed to have been performed with the purpose of extorting money from Mind & Motion and patients are not expected to experience any negative effects from the attack.

In response to the security breach, and as instructed by its IT vendor, Mind & Motion has reset all passwords and implemented controls to ensure complex passwords are set on all accounts in the future. A policy has also been introduced to force users to change passwords more frequently. Computers and servers have professional anti-malware solutions installed and will be regularly scanned. Mind & Motion has also implemented encryption on all its computers and the latest anti-spam technology has been deployed to protect against phishing attacks.

Promptly after the breach was detected, Mind and Motion hired a compliance consulting firm to make sure that all requirements of HIPAA were satisfied. The consulting firm will be administering further HIPAA compliance training to all staff within 30 days.

A breach report was submitted to the Department of Health and Human Services’ Office for Civil Rights on November 30, 2018 and all affected patients have been notified about the breach by mail. The OCR breach report indicates up to 16,000 patient records were potentially compromised.

The post 16,000 Mind & Motion Patients Impacted by Ransomware Attack appeared first on HIPAA Journal.