HIPAA Breach News

7,000 Patients Affected by Georgia Spine and Orthopaedics of Atlanta Phishing Attack

Posted November 29, 2018 by HIPAA Journal

Georgia Spine and Orthopaedics of Atlanta (GSOA) is alerting thousands of its patients that some of their protected health information has been exposed, and potentially stolen, as a result of a phishing attack.

An investigation into the data breach revealed an unauthorized individual gained access to an email account as a result of the employee responding to a phishing email. That response allowed the attacker to obtain the employee’s email account password.

Third-party computer forensics experts were contracted to conduct a detailed investigation into the attack to determine the extent of the breach and find out which patients had been affected. The investigation confirmed that a single email account had been compromised on July 11, 2018. An evaluation of GSOA’s technology systems was also conducted to ensure that they were secure.

In order to determine which patients had been affected, a painstaking manual analysis of all emails in the compromised account was performed to determine which messages had been accessed by the attacker.

GSOA reports that the way the email account was accessed would have allowed the attacker to view and save a desk copy of emails. GSOA said that if a copy of the data was obtained it was “likely unintentional,” but it is probable that a copy of the emails was retained by the attacker.

The manual review of emails in the account revealed they contained patients’ names and personal and medical information typically saved in medical records, although only a small number of the compromised emails contained patients’ Social Security and driver’s license numbers.

All patients whose protected health information was exposed/stolen have now been notified by mail. The breach report on the Department of Health and Human Services’ Office for Civil Rights website shows 7,012 patients have been affected by the breach.

The post 7,000 Patients Affected by Georgia Spine and Orthopaedics of Atlanta Phishing Attack appeared first on HIPAA Journal.

DOJ Indicts Two Iranian Hackers for Role in SamSam Ransomware Attacks

Posted November 29, 2018 by HIPAA Journal

The U.S. Department of Justice has announced significant progress has been made in the investigation of the threat actors behind the SamSam ransomware attacks that have plagued the healthcare industry over the past couple of years.

The DOJ, assisted the Royal Canadian Mounted Police, Calgary Police Service, and the UK’s National Crime Agency and West Yorkshire Police, have identified two Iranians who are believed to be behind the SamSam ransomware attacks.

Both individuals – Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri – have been operating out of Iran since 2016 and have been indicted on four charges:

Conspiracy to commit fraud and related computer activity
Conspiracy to commit wire fraud
Intentional damage to a protected computer
Transmitting a demand in relation to damaging a protected computer

The DOJ reports that this is the first ever U.S. indictment against criminals over a for-profit ransomware, hacking, and extortion scheme.

In contrast to many threat actors who use ransomware for extortion, the SamSam ransomware group conducts targeted, manual attacks on organizations. Most ransomware gangs use spam email and other mass distribution techniques to infect as many individuals as possible.

The SamSam ransomware group exploits vulnerabilities and conducts brute force RDP attacks to gain access to systems, then investigates networks and moves laterally before manually deploying ransomware on as many computers as possible.

This method of attack allows the threat actors to inflict maximum damage. With a large percentage of an organization’s computers and systems taken out of action, the gang can issue large ransom demands. The ransoms demanded are typically in the range of $5,000 to $50,000, with the amount based on the number of devices that have been encrypted.

In the two years that the gang has been deploying SamSam ransomware, approximately $6,000,000 in ransom payments have been collected from around 200 victims. Many victims chose not to pay the ransom demands but still incurred significant costs mitigating the attacks. The DOJ estimates that in addition to the ransom payments, additional losses from downtime due to the attacks has exceed $30 million.

The gang’s list of victims is long and includes the cities of Newark, New Jersey and Atlanta, the Colorado Department of Transportation, and the Port of San Diego. Healthcare industry victims include Hancock Health, Adams Memorial Hospital, Kansas Heart Hospital, Allied Physicians of Michiana, Cass Regional Medical Center, Nebraska Orthopedic Hospital, LabCorp of America, Allscripts, and MedStar Health.

Research by Sophos indicates 26% of attacks were on the healthcare organizations, 13% were on government agencies, 11% were on educational institutions, and 50% were on private companies. The attacks have primarily been conducted on organizations in the United States, with other victims spread across Canada, the UK, and the Middle East.

The DOJ said the SamSam ransomware gang “engaged in an extreme form of 21st-century digital blackmail, attacking and extorting vulnerable victims like hospitals and schools, victims they knew would be willing and able to pay.”

The DOJ will continue to work with international law enforcement agencies to gather evidence and bring those responsible to justice.

The DOJ has also taken the opportunity to spread the message that all industry sectors are at risk of being attacked. “This indictment highlight[s] the need for businesses, healthcare institutions, universities, and other entities to emphasize cyber security, increase threat awareness, and harden their computer networks,” wrote the DOJ in a press release announcing the indictment.

The post DOJ Indicts Two Iranian Hackers for Role in SamSam Ransomware Attacks appeared first on HIPAA Journal.

2.65 Million Atrium Health Patients Impacted by Business Associate Data Breach

Posted November 28, 2018 by HIPAA Journal

A data breach has been reported by AccuDoc Solutions Inc., a provider of healthcare billing services, that resulted in the exposure of the protected health information of 2,650,000 patients of Atrium Health.

Morrisville, NC-based AccuDoc Solutions prepares bills for patients and operates the online payment system used by Atrium Health, a network of 44 hospitals throughout North Carolina, South Carolina and Georgia.

On October 1, 2018, AccuDoc Solutions notified Atrium Health that some of its databases had been compromised. The breach investigation revealed hackers had gained access to AccuDoc Solutions databases between September 22 and September 29, 2018.

An extensive forensic investigation into the attack confirmed that patient information had been compromised, but the information stored in its databases could only be viewed. No PHI was downloaded by the attackers nor distributed via other channels.

AccuDoc Solutions reports that the breach was due to a security vulnerability at a third-party vendor. The business relationship with that vendor has now been terminated. AccuDoc Systems has locked out the hackers and has enhanced its security measures to prevent future attacks.

Atrium Health said the information compromised in the attack was limited to patients’ names, addresses, invoice numbers, account balances, service dates, and health insurance information. Approximately 700,000 Social Security numbers were also compromised; however, no sensitive financial information or medical records were affected.

“We are notifying the patients and guarantors who may have been impacted by this incident. We take cybersecurity very seriously, and we’ve worked very hard to determine exactly what happened, and how to prevent it from happening again,” said a spokesperson for Atrium Health. “The fact that even one record was accessed is one too many. Our patients expect us to keep all of their information private, which is why we took action so quickly.”

Atrium Health is now notifying all affected patients and has offered credit monitoring and identity theft protection services to patients impacted by the breach.

AccuDoc serves approximately 50 other healthcare providers; however only one other client was affected by the breach: Baylor Medical Center in Frisco, TX. Approximately 40,000 Baylor Medical Center patients were affected.

Based on the estimated number of individuals affected, this is the largest healthcare data breach since the 3,466,120-record breach at Newkirk Products Inc., that was reported to OCR in September 2016. It is the eleventh largest healthcare data breach reported since OCR started publishing breach summaries in 2009.

Largest Ever Healthcare Data Breaches

Rank	Entity	Entity Type	Individuals Affected	Breach Type	Date
1	Anthem Inc.	Health Plan	78,800,000	Hacking/IT Incident	Feb-15
2	Premera Blue Cross	Health Plan	11,000,000	Hacking/IT Incident	Mar-15
3	Excellus Health Plan, Inc.	Health Plan	10,000,000	Hacking/IT Incident	Sep-15
4	Science Applications International Corporation	Business Associate	4,900,000	Loss	Nov-11
5	University of California, Los Angeles Health	Healthcare Provider	4,500,000	Hacking/IT Incident	Jul-15
6	Community Health Systems Professional Services Corporation	Business Associate	4,500,000	Hacking/IT Incident	Aug-14
7	Advocate Health and Hospitals Corporation, dba Advocate Medical Group	Healthcare Provider	4,029,530	Theft	Aug-13
8	Medical Informatics Engineering	Business Associate	3,900,000	Hacking/IT Incident	Jul-15
9	Banner Health	Healthcare Provider	3,620,000	Hacking/IT Incident	Aug-16
10	Newkirk Products, Inc.	Business Associate	3,466,120	Hacking/IT Incident	Aug-16
11	AccuDoc Solutions Inc.	Business Associate	2,650,000	Hacking/IT Incident	Nov-18
12	21st Century Oncology	Healthcare Provider	2,213,597	Hacking/IT Incident	Mar-16

The post 2.65 Million Atrium Health Patients Impacted by Business Associate Data Breach appeared first on HIPAA Journal.

Tandigm Health Website Vulnerability Exposed 7,000 Patients’ PHI

Posted November 27, 2018 by HIPAA Journal

A vulnerability on a website used by the value-based healthcare company Tandigm Health could potentially have been exploited to gain access to patients’ protected health information.

The website vulnerability was discovered by Tandigm Health on September 25, 2018. A leading computer forensics firm assisted with the investigation to determine whether the flaw could be exploited remotely, whether patients’ protected health information had been accessed, and the types of information that may have been exposed.

The investigation confirmed that the flaw could have been exploited to gain access to sensitive patient information between April 24, 2017 and December 31, 2017. The information accessible through the website was limited to names, birth dates, medical information, and health insurance information. Approximately 7,000 patients’ protected health information was accessible through the website.

The investigation did not uncover any evidence to suggest the flaw had been exploited and no reports been received to suggest patient information has been stolen or misused.

Out of an abundance of caution, all individuals whose personal and health information were exposed have been notified of the potential breach by mail and have been offered free credit monitoring and identity theft protection services for 2 years.

Affected individuals have been advised to monitor their accounts and credit reports for any sign of unauthorized transactions and to review explanation of benefits statements from their health insurers for any medical services that have been listed but not received.

According to a company press release, “Information privacy and security are among Tandigm’s highest priorities, and there are strict security measures in place to protect information in Tandigm’s care.”

Tandigm Health has reassessed its website protections and has enhanced security on its Internet-based platforms. Current policies and procedures covering data security have been reviewed and additional, ongoing data security training is being provided to employees.

The post Tandigm Health Website Vulnerability Exposed 7,000 Patients’ PHI appeared first on HIPAA Journal.

Mercy Medical Center North Iowa Notifies 1,900 Patients About Potential PHI Exposure

Posted November 27, 2018 by HIPAA Journal

Mercy Medical Center North Iowa has discovered a former employee potentially accessed the medical records of patients without authorization over a period of 12 months.

An internal investigation suggested a former employee had inappropriately accessed patient information between July 2017 and July 2018. The employee had been given access to patient information to complete work duties, but Mercy Medical Center North Iowa was unable to confirm whether all records had been accessed for appropriate job-related purposes.

The types of information the former employee accessed was limited to names, addresses, birth dates, medications, and insurance information.

Breach notification letters were mailed to affected patients on November 26, 2018 and all individuals whose personal information was exposed have been offered 12 months of complimentary identity theft protection services.

The discovery of the unauthorized access has prompted Mercy Medical Center North Iowa to review its privacy practices and further training will be provided to employees to reinforce past training on hospital and HIPAA Rules related to patient privacy.

Mercy Medical Center North Iowa issued the following statement about the breach. “Mercy-North Iowa takes very seriously the responsibility to safeguard the protected health information of patients and apologizes for any concern or inconvenience this situation may cause.”

The privacy violation has been reported to law enforcement and the HHS’ Office for Civil Rights. The Globe Gazette has reported that approximately 1,900 current and former patients have been notified about the breach.

3,930 Patients of Arthritis & Osteoporosis Consultants of the Carolinas Notified About PHI Breach

3,930 patients of Charlotte, NC-based Arthritis & Osteoporosis Consultants of the Carolinas (AOCC) have been notified that some of their protected health information has been exposed.

A report containing patients’ personal and medical information was discovered to be missing on September 10, 2018. AOCC believes the report was accidentally discarded in the trash without first being shredded.

AOCC does not believe the report has been viewed by anyone other than authorized AOCC staff and no reports have been received to suggest patient information has been misused.

The following information was listed in the report: Names, birth dates, payer-issued ID numbers, insurance information, names of treating physicians, and for certain patients, the name of an infusion drug that had been administered.

The post Mercy Medical Center North Iowa Notifies 1,900 Patients About Potential PHI Exposure appeared first on HIPAA Journal.

OCR Fines Allergy Practice $125,000 for Impermissible PHI Disclosure

Posted November 26, 2018 by HIPAA Journal

The Department of Health and Human Services’ Office for Civil Rights (OCR) has fined a Hartford allergy practice $125,000 to revolve potential violations of the HIPAA Privacy Rule.

On October 6, 2015, OCR received a copy of a civil rights complaint that had been filed with the Department of Justice (DOJ). The complainant alleged Allergy Associates of Hartford – A Connecticut healthcare provider that specializes in treating patients with allergies – had impermissibly disclosed her protected health information to a TV reporter.

The complainant had previously contacted a local TV station after she had been turned away from the allergy practice because of her service animal. The TV reporter subsequently contacted the practice seeking comment. A physician at the practice spoke to the reporter and impermissibly disclosed some of the patient’s protected health information.

OCR’s investigation confirmed there had been an impermissible disclosure of PHI, in violation of the HIPAA Privacy Rule – 45 C.F.R. § 164.502(a).

The physician in question had already been advised by the practice’s Privacy Officer to ignore the reporter’s request for comment or to respond with ‘no comment.’ However, the physician chose to speak with the reporter and disclosed some of the patient’s PHI. OCR viewed the disclosure as ‘a reckless disregard for the patient’s privacy rights.’

After Allergy Associates was contacted by OCR about the privacy breach, Allergy Associates failed to apply appropriate sanctions against the physician concerned for a violation of the practice’s privacy policies and procedures, as is required by the HIPAA Privacy Rule – 45 C.F.R. §164.530(e)(l).

“When a patient complains about a medical practice, doctors cannot respond by disclosing private patient information to the media,” explained OCR Director Roger Severino. “Because egregious disclosures can lead to substantial penalties, covered entities need to pay close attention to HIPAA’s privacy rules, especially when responding to press inquiries.”

Allergy Associates agreed to settle the case with no admission of liability. In addition to paying a financial penalty of $125,000, Allergy Associates has agreed to adopt a robust corrective action plan which includes two years of OCR monitoring the practice’s compliance with HIPAA Rules.

The post OCR Fines Allergy Practice $125,000 for Impermissible PHI Disclosure appeared first on HIPAA Journal.

53% Of Healthcare Data Breaches Due to Insiders and Negligence

Posted November 22, 2018 by HIPAA Journal

The healthcare industry has had more than its fair share of hacking incidents, but the biggest threat comes from within. The actions of healthcare providers, health insurers, and their employees cause more breaches than hacks, malware, and ransomware attacks.

Researchers at Michigan State University and Johns Hopkins University analyzed data breaches reported to the Department of Health and Human Services’ Office for Civil Rights (OCR) over the past 7 years and found that more than half of breaches were the result on internal negligence.

The research study, which was recently published in the journal JAMA Internal Medicine, is a follow-on from a 2017 study that explored the risk of hospital data breaches and the types of hospitals that were most prone to data breaches. While the previous research cast light on which hospitals were most vulnerable, little information was available on the main causes of the breaches. The latest study addresses that gap in knowledge.

The researchers performed a retrospective analysis of the 1,183 healthcare data breaches reported to OCR between October 21, 2009 and December 31, 2017. Those breaches resulted in the exposure of 164 million healthcare records.

The analysis was limited to breaches of 500 or more records, as OCR does not publish summaries of smaller breaches. The breach reports split data breaches into six categories; hacking/IT incidents, unauthorized access/disclosure incidents, theft, loss, improper disposal, and unknown. 77.6% of breaches were correctly classified and 22.24% were misclassified or the cause was unknown.

The researchers discovered that theft of data by third-parties or unknown individuals was the single leading breach cause, accounting for 32.5% of incidents, with mailing errors in second place (10.5%), followed by theft by current or former employees (9%). Internal/external hacking incidents accounted for around 20% of breaches, although those incidents involved 133.8 million of the 164 million compromised records. 53% of all breaches were found to have originated from inside healthcare organizations.

“One quarter of all the cases were caused by unauthorized access or disclosure – more than twice the amount that were caused by external hackers,” said Xuefeng Liang, associate professor of accounting and information systems at MSU’s Eli Broad College of Business and lead author of the study. “This could be an employee taking PHI home or forwarding to a personal account or device, accessing data without authorization, or even through email mistakes, like sending to the wrong recipients, copying instead of blind copying or sharing unencrypted content.”

An analysis of the location of breached PHI showed 46.1% of breaches involved mobile devices, paper records were involved in 28.7% of breaches and 29.3% of breaches involved network servers.

Typically, the actions taken by healthcare organizations post-breach were the use of encryption software, restricting the use of mobile devices, switching to digital records, improving physical security, strengthening firewalls and other cybersecurity protections, and enhancing monitoring and auditing.

While many breaches involve little risk to patients – the accidental disclosure of a name and address to another patient – the consequences of some breaches can be severe: For patients as well as the breached entity. Anthem Inc’s 78.8 million record breach in 2015 was used as an example. Many breach victims had tax returns filed in their names, resulting in financial losses.

In addition to the considerable cost of mitigating the breach – improving cybersecurity protections; hiring forensic investigators, cybersecurity consultants, and legal advisors; printing and mailing notification letters; providing credit monitoring services for breach victims – Anthem had to cover the cost of defending multiple class action lawsuits, which were ultimately settled for $115 million. Anthem has also recently been fined $16 million by OCR to resolve the HIPAA violations uncovered during its breach investigation. Anthem’s reputation has also been tarnished by the breach, the cost of which is difficult to calculate.

The findings of the study are important. “Healthcare entities must understand the causes of PHI breaches if they aim to effectively manage the trade-off between wider access or higher efficiency and more security,” explained the researchers in the paper.

The post 53% Of Healthcare Data Breaches Due to Insiders and Negligence appeared first on HIPAA Journal.

October 2018 Healthcare Data Breach Report

Posted November 21, 2018 by HIPAA Journal

Our October 2018 healthcare data breach report shows there has been a month-over-month increase in healthcare data breaches with October seeing more than one healthcare data breach reported per day.

31 healthcare data breaches were reported by HIPAA-covered entities and their business associates in October – 6 incidents more than the previous month. It should be noted that one breach at a business associate was reported to OCR as three separate breaches.

The number of breached records in September (134,006) was the lowest total for 6 months, but the downward trend did not continue in October. There was a massive increase in exposed protected health information (PHI) in October. 2,109,730 records were exposed, stolen or impermissibly disclosed – 1,474% more than the previous month. In October, the average breach size was 68,055 records and the median was 4,058 records.

Largest Healthcare Data Breaches in October 2018

There were 11 healthcare data breaches of more than 10,000 records reported in October – A 120% increases from the five 10,000+ record breaches in September. The largest healthcare data breach in October resulted in the exposure of 1.24 million records: An unauthorized access/disclosure incident at Employees Retirement System of Texas. A flaw in its ERS Online portal allowed members to view the PHI of other members.

566,217 records were exposed in a breach at Banker’s Life, a division of CNO Financial Group Inc., also an unauthorized access/disclosure incident. Employee credentials were stolen and used to gain access to company websites, resulting in the exposure and potential theft of policyholder and applicant information.

Rank	Name of Covered Entity	Covered Entity Type	Individuals Affected	Type of Breach
1	Employees Retirement System of Texas	Health Plan	1248263	Unauthorized Access/Disclosure
2	CNO Financial Group, Inc.	Health Plan	566217	Unauthorized Access/Disclosure
3	Health First, Inc	Healthcare Provider	42000	Hacking/IT Incident
4	Jones Eye Center, P.C.	Healthcare Provider	39605	Hacking/IT Incident
5	Gold Coast Health Plan	Business Associate	37005	Hacking/IT Incident
6	The May Eye Care Center	Healthcare Provider	30000	Hacking/IT Incident
7	CJ Elmwood Partners, L.P.	Healthcare Provider	22416	Hacking/IT Incident
8	Minnesota Department of Human Services	Health Plan	20800	Hacking/IT Incident
9	Catawba Valley Medical Center	Healthcare Provider	20000	Hacking/IT Incident
10	National Ambulatory Hernia Institute	Healthcare Provider	15974	Hacking/IT Incident

Causes of October 2018 Healthcare Data Breaches

Unauthorized access/disclosure breaches resulted in the highest number of compromised records, but hacking/IT incidents were more common in October. October saw 16 hacking/IT incidents reported, 11 unauthorized access/disclosure incidents, and four theft incidents. There were no reports of lost PHI/ePHI and no improper disposal incidents.

Healthcare Records Exposed by Breach Cause

Location of Breached Protected Health Information

Phishing is arguably the biggest cyber threat faced by healthcare organizations and October saw many phishing attacks reported by healthcare providers. In October, there were 9 incidents involving PHI exposure via email. There were also 9 network server-related breaches, which included hacks, malware, and ransomware attacks.

Data Breaches by Covered-Entity Type

In terms of the number of incidents, healthcare providers were the worst hit by data breaches in October with 20 reported breaches, followed by health plans/health insurers with 7. Four HIPAA business associate breaches were reported, three of which were by the same business associate – HealthFitness. One further breach had some business associate involvement.

In terms of the number of exposed records, health plans/insurers fared worse than other HIPAA-covered entities. 1,848,235 healthcare records were exposed at health plans/insurers, 221,994 healthcare records were exposed in healthcare provider breaches, and 39,501 records exposed by business associates.

Healthcare Data Breaches by State

Texas was worst affected by healthcare data breaches in October. 5 breaches were reported by covered entities/business associates based in Texas. California, Connecticut, Illinois, and Washington each had 3 breaches reported. There were two breaches reported in each of Florida, Iowa, Indiana, and Pennsylvania. Minnesota, Missouri, North Carolina, New Mexico, Oklahoma, and Oregon had one breach apiece.

Penalties for HIPAA Violations in October

After a period of quiet on the HIPAA penalty front, the Department of Health and Human Services’ Office for Civil Rights announced three settlements in September related to filming patients without consent. There were followed up in October with a massive fine for Anthem Inc.

The Anthem Inc., HIPAA violation penalty was expected, and given the scale of the breach (78.8 million records), the penalty was likely to be large. After assessing the extent of HIPAA violations, the scale of the breach, and its impact, OCR fined Anthem $16,000,000. The previous largest ever HIPAA penalty was $5,550,000 (Advocate Health Care Network, 2016)

In October, a multi-state action against the health insurer Aetna was concluded and settlements were reached to resolve the HIPAA violations. The penalties related to the impermissible disclosure of 13,160 plan members’ HIV/AIDS diagnoses via a mailing. Settlements were reached with Connecticut, New Jersey, and the District of Columbia totaling $640,170. Washington was also part of the multi-state action, but the settlement amount has not yet been decided.

The post October 2018 Healthcare Data Breach Report appeared first on HIPAA Journal.

Key Dental Group Alerts Patients About Potential HIPAA Violation

Posted November 21, 2018 by HIPAA Journal

Key Dental Group, a dental practice in Pembroke Pines, FL, is informing its patients about an alleged HIPAA violation which has potential to result in the unauthorized accessing of their protected health information (PHI).

After changing its electronic medical record (EMR) database provider, Key Dental Group requested its former vendor, MOGO, the return its EMR database. Even though the end user license agreement (EULA) stated that all patient data must be returned on termination of the agreement, MOGO has refused to return the database.

MOGO communicated to Key Dental Group, via its attorney, that the database would not be returned. The Pembroke Pines dental practice alleges that in addition to violating the EULA, MOGO, as a HIPAA business associate, is in violation of the Health Insurance Portability and Accountability Act.

Any security breach, such as the unauthorized accessing of patients’ protected health information, requires notifications to be sent to affected patients. Key Dental Group cannot say whether the database has been accessed after the termination of the EULA, but since the KDG-MOGO database can no longer be accessed, monitored, or protected from unauthorized access, notifications were deemed necessary.

“While Key Dental Group cannot definitively say that unauthorized access has or will occur to this database, given the apparent violations of various portions of HIPAA triggered by MOGO’s actions and the sensitivity of the information the database contains, Key Dental Group, PA is publicly notifying its patients at this time of this incident,” wrote Key Dental Group in a recent press release about the HIPAA incident.

All patients whose PHI – which includes names, addresses, dates of birth, medical histories, diagnoses/conditions, lab/test results, treatment information, medications, health insurance information, claims information, and the Social Security numbers of some Medicare/Medicaid patients – is present in the database have been told to be alert to the possibility of identity theft and fraud.

The post Key Dental Group Alerts Patients About Potential HIPAA Violation appeared first on HIPAA Journal.

Daily HIPAA News, HIPAA RSS Feeds, HIPAA Information