Critical Care, Pulmonary & Sleep Associates (CCPSA) in Colorado has experienced a data breach that has impacted more than 23,300 patients.

An email account breach was detected by CCPSA on November 23, 2018 when suspicious activity was detected related to an employee’s email account. The account appeared to have been used to send phishing emails to individuals in the employee’s contact list. Those emails attempted to convince the recipients to make fraudulent payments.

Action was promptly taken to lock the hacker out of the account and the entire email environment was secured. All users were required to set new, complex passwords. A third-party computer forensics firm was hired to investigate the attack and determine the scale of the breach. That investigation was concluded on December 14, 2018.

The investigation revealed the attacker had gained access to multiple email accounts between August 14 and November 23, 2018. The breach was determined to be limited to the email system. Its medical record system was unaffected.

An analysis of the compromised email accounts revealed they contained the electronic protected health information of more than 23,300 patients. In addition to patients’ names, the following information was also potentially compromised: Addresses, email addresses, phone numbers, dates of birth, dates of service, diagnoses, medical conditions, lab test results, information related to diagnostic studies, treatment information, insurance information, and for certain patients, costs of medical services, Social Security numbers, and driver’s license numbers.

Prior to the attack, CCPSA had implemented protections to prevent successful phishing attacks. Those protections have now been enhanced. Additionally, changes have been made to how authorized individuals can access the network and changes have also been made by the IT department to certain rules within its computer environment. Additional, mandatory security awareness training has also been provided to the entire workforce.

According to the breach summary posted on the Department of Health and Human Services’ Office for Civil Rights breach portal, the ePHI of 23,377 has been exposed.

The post 23,300 Patients Affected by Critical Care, Pulmonary & Sleep Associates Email Hack appeared first on HIPAA Journal.

All-Star Orthopaedics is alerting patients of Irving, TX-based Las Colinas Orthopedic Surgery & Sports Medicine, PA, that some of their protected health information (PHI) was stored on a hard drive that has been stolen.

The hard drive contained X-ray and other diagnostic images of 76,000 patients, along with patients’ names and dates of birth. While the hard drive was not encrypted, special software is required to access the images. The image files would need to be opened in order to see patients’ names and dates of birth.

The hard drive was stolen on November 20, 2018. The theft was reported to the Department of Health and Human Services’ Office for Civil Rights on January 18, 2019 and breach notification letters have now been sent to all affected patients.

The theft has prompted All-Star Orthopaedics to implement new security protocols to prevent any further breaches of patients PHI and all portable hard drives will now be encrypted prior to transport.

Dermacare Brickell Data Breach Impacts 1,800 Patients

On November 20, 2018, the Miami medical practice Dermacare Brickell discovered paperwork containing the PHI of around 1,800 patients was missing.

The paperwork had been removed from a locked storage unit at The Vue Condominium, close to its office. The files related to patients who had received medical services at the practice between 2010 and 2013.

The medical practice determined that boxes of files had been mistakenly removed and disposed of a condominium association dumpster along with regular trash. The person responsible assured the practice that he did not read any of the files in the boxes and was unaware that the boxes contained patient files.

The improper disposal has been reported to the Miami Police Department and patients have been notified as a precaution, although no evidence has been uncovered to suggest any information has been viewed by unauthorized individuals or misused.

The files did not contain financial information or Social Security numbers, only names, birth dates, previous medical histories as provided by patients, and practice treatment notes.

All patient files will now be stored within its offices. The practice is in the process of transitioning to electronic medical records and all paper copies of records will be shredded once that process has been completed.

The post Stolen Hard Drive Contained PHI of 76,000 Texas Patients appeared first on HIPAA Journal.

Midwest, has announced that an unauthorized individual has gained access to the email account of an employee.

Valley Hope Association became aware of a potential account breach on October 10, 2018, when unusual account activity was detected. Prompt action was taken to prevent further account access and a third-party computer forensics firm was hired to determine the nature and scope of the breach.

The investigation confirmed on November 23, 2018, that an unauthorized individual had accessed a single email account between October 9-10, 2018, and potentially viewed emails and attachments containing patients’ protected health information. After a thorough review of all emails and email attachments, the forensics firm confirmed that certain patients’ PHI may have been accessed.

The types of information contained in the emails varied from patient to patient and may have included one or more of the following data elements: Name, address, date of birth, Social Security number, medication and prescription information, claims and billing information, medical record number, health insurance information, and physician’s name. No diagnosis or treatment information was contained in the emails.

Following the confirmation of exposed information, Valley Hope Association has been attempting to identify current contact information for all affected individuals and each will be notified and told about the exact information that has potentially been compromised. While data access/theft is a possibility, no reports have been received to suggest any patient information has been misused.

As a precaution against identity theft and fraud, patients impacted by the breach have been offered 12 months of complimentary identity theft monitoring services through Kroll.

Valley Hope Association has been reviewing and revising its policies and procedures to further protect the security and confidentiality of information on its systems and additional safeguards will be implemented as appropriate.

The breach has been reported to law enforcement, state regulators, credit monitoring bureaus, and the Department of Health and Human Services Office’ for Civil Rights.

The incident has yet to appear on the OCR breach portal, so it is currently unclear exactly how many patients have been impacted by the breach.

The post Valley Hope Association Notifies Patients of Email Account Breach appeared first on HIPAA Journal.

Lebanon VA Medical Center in Pennsylvania has discovered the protected health information of hundreds of elderly patients has been impermissibly disclosed to a family member of a veteran.

In November 2018, a member of staff at Lebanon VA Medical Center emailed a document to a family member of a veteran who was searching for nursing home facilities. The list should have contained nursing home facilities that work with the Department of Veteran Affairs; however, a historical list of residents of nursing homes was sent in error.

The list contained veterans’ names, abbreviated Social Security numbers, the nursing home where the veteran had been admitted, diagnoses, and service-connection disability rating percentages.

“Lebanon VA Medical Center and our employees take our responsibility to protect patient information very seriously,” explained Lebanon VA privacy officer Tonya Hromco. “Along with assistance from national offices, we immediately investigated this inadvertent, unauthorized release of information which occurred in late November.”

The incident was an isolated error and steps have now been taken to reduce the potential for further mistakes. Additional controls have been implemented in the section where the error occurred and throughout its facility. Files containing historic information have now been encrypted and restrictions have been placed on the number of individuals with access to those files. Technical controls have also been implemented that prevent members of the department from sending email attachments externally.

A press release issued by Lebanon VA Medical Center says the PHI of 993 individuals was impermissibly disclosed. The breach report on the HHS’ Office for Civil Rights’ breach portal suggests the breach could have impacted up to 1,002 individuals.

Individuals affected by the privacy breach and family members of deceased patients have recently been mailed breach notification letters.

The post PHI of Almost 1,000 Lebanon VA Medical Center Patients Impermissibly Disclosed appeared first on HIPAA Journal.

Centerstone Insurance and Financial Services, operating as BenefitMall, has started notifying more than 111,000 individuals that some of their protected health information has been exposed, and potentially stolen, in a recent email security incident.

Dallas, TX-based BenefitMail is a provider of employee benefits, payroll, HR, and employer services and employs more than 20,000 advisors, brokers, and CPAs across the country. The company is a business associate of several HIPAA-covered entities.

On October 11, 2018, the company became aware that email accounts used by its employees had been accessed by an unauthorized individual. A third-party computer forensics firm was retained and an internal investigation was conducted to assess the nature and scope of the breach.

The investigation revealed the first email accounts had been compromised in June 2018 and further email accounts were breached and accessed up to October 11 when the attack was detected. Prompt action was taken to secure the compromised email accounts and prevent further remote email account access. The email accounts were compromised as a result of employees falling for phishing scams.

An analysis of the compromised email accounts revealed many emails in those accounts contained the personal information of individuals related to the services provided. The information exposed and potentially stolen was limited to names, addresses, social security numbers, dates of birth, bank account numbers, and information relating to payment of insurance premiums.

The security breach has prompted BenefitMail to review its email security controls, which have now been augmented to provide greater protection against phishing attacks. Two-factor authentication has now been implemented on its email system and employees have been provided with further training to improve awareness of phishing scams and how to guard against them. Further security awareness and phishing training will be provided to employees on an ongoing basis.

The security breach has been reported to law enforcement and BenefitMail will continue to assist with their investigation and will work closely with the insurance providers whose members were affected by the breach.. The Department of Health and Human Services’ Office for Civil Rights (OCR) has been notified. The breach report submitted to OCR indicates 111,589 individuals have been affected by the breach.

The post 111K Individuals Notified of 4-Month Email Account Compromise appeared first on HIPAA Journal.