A vulnerability on a website used by the value-based healthcare company Tandigm Health could potentially have been exploited to gain access to patients’ protected health information.

The website vulnerability was discovered by Tandigm Health on September 25, 2018. A leading computer forensics firm assisted with the investigation to determine whether the flaw could be exploited remotely, whether patients’ protected health information had been accessed, and the types of information that may have been exposed.

The investigation confirmed that the flaw could have been exploited to gain access to sensitive patient information between April 24, 2017 and December 31, 2017. The information accessible through the website was limited to names, birth dates, medical information, and health insurance information. Approximately 7,000 patients’ protected health information was accessible through the website.

The investigation did not uncover any evidence to suggest the flaw had been exploited and no reports been received to suggest patient information has been stolen or misused.

Out of an abundance of caution, all individuals whose personal and health information were exposed have been notified of the potential breach by mail and have been offered free credit monitoring and identity theft protection services for 2 years.

Affected individuals have been advised to monitor their accounts and credit reports for any sign of unauthorized transactions and to review explanation of benefits statements from their health insurers for any medical services that have been listed but not received.

According to a company press release, “Information privacy and security are among Tandigm’s highest priorities, and there are strict security measures in place to protect information in Tandigm’s care.”

Tandigm Health has reassessed its website protections and has enhanced security on its Internet-based platforms. Current policies and procedures covering data security have been reviewed and additional, ongoing data security training is being provided to employees.

The post Tandigm Health Website Vulnerability Exposed 7,000 Patients’ PHI appeared first on HIPAA Journal.

Mercy Medical Center North Iowa has discovered a former employee potentially accessed the medical records of patients without authorization over a period of 12 months.

An internal investigation suggested a former employee had inappropriately accessed patient information between July 2017 and July 2018. The employee had been given access to patient information to complete work duties, but Mercy Medical Center North Iowa was unable to confirm whether all records had been accessed for appropriate job-related purposes.

The types of information the former employee accessed was limited to names, addresses, birth dates, medications, and insurance information.

Breach notification letters were mailed to affected patients on November 26, 2018 and all individuals whose personal information was exposed have been offered 12 months of complimentary identity theft protection services.

The discovery of the unauthorized access has prompted Mercy Medical Center North Iowa to review its privacy practices and further training will be provided to employees to reinforce past training on hospital and HIPAA Rules related to patient privacy.

Mercy Medical Center North Iowa issued the following statement about the breach. “Mercy-North Iowa takes very seriously the responsibility to safeguard the protected health information of patients and apologizes for any concern or inconvenience this situation may cause.”

The privacy violation has been reported to law enforcement and the HHS’ Office for Civil Rights. The Globe Gazette has reported that approximately 1,900 current and former patients have been notified about the breach.

3,930 Patients of Arthritis & Osteoporosis Consultants of the Carolinas Notified About PHI Breach

3,930 patients of Charlotte, NC-based Arthritis & Osteoporosis Consultants of the Carolinas (AOCC) have been notified that some of their protected health information has been exposed.

A report containing patients’ personal and medical information was discovered to be missing on September 10, 2018. AOCC believes the report was accidentally discarded in the trash without first being shredded.

AOCC does not believe the report has been viewed by anyone other than authorized AOCC staff and no reports have been received to suggest patient information has been misused.

The following information was listed in the report: Names, birth dates, payer-issued ID numbers, insurance information, names of treating physicians, and for certain patients, the name of an infusion drug that had been administered.

The post Mercy Medical Center North Iowa Notifies 1,900 Patients About Potential PHI Exposure appeared first on HIPAA Journal.

Key Dental Group, a dental practice in Pembroke Pines, FL, is informing its patients about an alleged HIPAA violation which has potential to result in the unauthorized accessing of their protected health information (PHI).

After changing its electronic medical record (EMR) database provider, Key Dental Group requested its former vendor, MOGO, the return its EMR database. Even though the end user license agreement (EULA) stated that all patient data must be returned on termination of the agreement, MOGO has refused to return the database.

MOGO communicated to Key Dental Group, via its attorney, that the database would not be returned. The Pembroke Pines dental practice alleges that in addition to violating the EULA, MOGO, as a HIPAA business associate, is in violation of the Health Insurance Portability and Accountability Act.

Any security breach, such as the unauthorized accessing of patients’ protected health information, requires notifications to be sent to affected patients. Key Dental Group cannot say whether the database has been accessed after the termination of the EULA, but since the KDG-MOGO database can no longer be accessed, monitored, or protected from unauthorized access, notifications were deemed necessary.

“While Key Dental Group cannot definitively say that unauthorized access has or will occur to this database, given the apparent violations of various portions of HIPAA triggered by MOGO’s actions and the sensitivity of the information the database contains, Key Dental Group, PA is publicly notifying its patients at this time of this incident,” wrote Key Dental Group in a recent press release about the HIPAA incident.

All patients whose PHI – which includes names, addresses, dates of birth, medical histories, diagnoses/conditions, lab/test results, treatment information, medications, health insurance information, claims information, and the Social Security numbers of some Medicare/Medicaid patients – is present in the database have been told to be alert to the possibility of identity theft and fraud.

The post Key Dental Group Alerts Patients About Potential HIPAA Violation appeared first on HIPAA Journal.

FHN Healthcare, which operates FHN Memorial Hospital in Freeport, IL, and a network of family healthcare centers throughout northwest Illinois, has learned that a laptop computer containing the protected health information of 4,458 patients has been stolen from the vehicle of an employee.

The theft was immediately reported to law enforcement, but the device has not been recovered. FHN Healthcare reconstructed the data stored on the device and discovered it contained names, addresses, birth dates, medical record numbers, health insurance information, medical information, Social Security numbers, and driver’s license numbers.

FHN healthcare already encrypts all its laptop computers, although the investigation into the incident revealed that the stolen device had not been encrypted and was only protected with a password. FHN reports that the lack of encryption was due to a technical issue with its encryption software and that the missed device was an isolated incident.

The discovery of the encryption failure has prompted FHN Healthcare to re-encrypt all its laptop computers. The employee who was issued with the laptop has been retrained on safeguarding mobile devices and the re-training has also been extended to other employees.

All patients impacted by the breach were notified by mail on November 2, 2018. Patients whose Social Security number or driver’s license number were exposed have been offered complimentary identity theft protection services for 12 months.

The post Stolen FHN Healthcare Laptop Contained the PHI of 4,458 Patients appeared first on HIPAA Journal.

New York Oncology Hematology in Albany, NY, has announced that hackers have gained access to 15 employee email accounts which contained the sensitive information of as many as 128,400 current and former patients and employees.

As is common in phishing attacks, the emails contained a hyperlink to a seemingly legitimate email login page which requested usernames and passwords. When the information was entered it was harvested by the attackers.

According to the substitute breach notice on the New York Oncology Hematology website, each compromised email account only remained accessible for a short period of time before access was terminated. The email breaches were identified by New York Oncology Hematology’s IT vendor, which shut down access to the compromised accounts by resetting the passwords.

Access to 14 email accounts was gained on April 20, and a second attack took place between April 21 and April 27, which resulted in a further email account being compromised.

New York Oncology Hematology hired a third-party computer forensics firm to investigate the breach and, on October 1, 2018, the firm confirmed that the compromised email accounts contained the protected health information of patients and sensitive employee information. The breach was restricted to patients and employees who joined New York Oncology Hematology prior to April 27, 2018.

The types of information in the compromised accounts differed from individual to individual and may have included names, home addresses, email addresses, dates of birth, insurance information, medical information, diagnostic codes, test results, account numbers, and dates of service. A limited number of patient and employee Social Security and driver’s license numbers were also exposed.

New York Oncology Hematology has not uncovered any evidence to suggest that sensitive information was accessed or stolen by the attackers and no reports have been received to suggest data misuse.

Out of an abundance of caution, New York Oncology Hematology is offering all affected individuals 12 months of complimentary credit and identity theft monitoring services through Experian. New York Oncology Hematology has since taken steps to improve email security.

All individuals potentially impacted by the incident were notified of the breach on November 16, 2018. Given that unauthorized access was rapidly detected and blocked, it is unclear why it took almost 7 months for notification letters to be issued.

The post 128,400 Employees and Patients Impacted by Phishing Attack on Albany Cancer Treatment Center appeared first on HIPAA Journal.

Certain current and former patients of St. John’s Episcopal Hospital and Episcopal Health Services in New York are being notified that some of their protected health information has potentially been compromised.

On September 18, 2018, Episcopal Health Services became aware of suspicious activity in several employee email accounts. An investigation was immediately launched, and a third-party digital forensics firm was called in to determine the nature and scope of the breach. The investigation revealed multiple employee email accounts had been compromised between August 28, 2018 and October 5, 2018.

A thorough review of the compromised email accounts was completed on November 1. The types of information exposed differed from patient to patient but may have included name, date of birth, Social Security number, medical history, prescription information, diagnoses, treatment information, medical record number, financial information, and health insurance information.

“Episcopal Health Services is committed to, and takes very seriously, its responsibility to protect all data entrusted to us. We are continuously taking steps to enhance data security protections,” explained Episcopal Health Services in its substitute breach notice. The measures taken to improve security include a forced password reset on all employee email accounts and the implementation of additional email security controls to prevent further unauthorized access.

While no evidence of data theft or misuse was uncovered during the investigation, out of an abundance of caution, Episcopal Health Services has offered all affected individuals 12 months of credit monitoring services without charge. Due to the sensitive nature of the information that was exposed, Episcopal Health Services has advised patients to monitor their account statements for any sign of suspicious activity.

It is currently unclear how many patients have been impacted by the breach.

The post Email Hacking Incident Reported by Episcopal Health Services appeared first on HIPAA Journal.