HIPAA Breach News

OIG Publishes 2016 Medicaid Data Breach Report

Posted by HIPAA Journal

A new report released by the Department of Health and Human Services’ Office of Inspector General (OIG) has revealed the vast majority of Medicaid data breaches are relatively minor and only affect an extremely limited number of individuals.

For the study, OIG assessed all breaches reported by Medicaid agencies and their contractors in 2016. According to the report, the records of 515,000 Medicaid beneficiaries were exposed in 2016, spread across 1,260 data breaches.

Almost two thirds of Medicaid data breaches reported in 2016 affected a single person with a further 29% of breaches affecting between 1 and 9 individuals. Large-scale breaches, which resulted in the data of 500 or more beneficiaries being exposed, accounted for 1% of the annual total.

While the breach causes were highly varied, the majority of incidents were the result of simple errors such as misaddressing a letter, fax, or email. Those breaches only resulted in a very limited amount of PHI being exposed, such as a beneficiary name and Medicaid or other ID number. Out of the 1,260 breaches only 303 resulted in the exposure of a Social Security number and just 23 involved financial information. Hackers may be responsible for a large percentage of healthcare data breaches, but there were only 9 hacking incidents reported in 2016 that resulted in the exposure of Medicaid data.

Image source: HHS Office of Inspector General

OIG explained that previous reviews have concentrated on identifying vulnerabilities in states’ information systems and controls, which could potentially be exploited to gain access to Medicaid systems and data. This review was concerned with the breach response when security incidents occur. An efficient breach response can limit the potential for harm such as identify theft.

In addition to an analysis of Medicaid data breaches, OIG also assessed the breach response policies and procedures in 50 states and the District of Columbia. OIG discovered a common breach reporting framework has been adopted by the majority of U.S. states, which covers investigations of breaches and their scope, the best way to respond to data breaches, how to protect breach victims, and identifying the actions to take to correct vulnerabilities to prevent future security incidents. OIG also assessed the responses to individual breaches in nine states to gain a better understanding of the breach response processes.

OIG noted that the breach response processes varied slightly from state to state, with all meeting the requirements of HIPAA as well as state-specific laws. While all breaches were reported to the HHS’ Office for Civil Rights to meet the requirements of the HIPAA Breach Notification Rule, many states failed to routinely notify the Centers for Medicare & Medicaid Services (CMS) separately, even though the CMS has required states to do so since 2006.

OIG suggests that this was likely due to the introduction of the HIPAA Breach Notification Rule in 2009.

The failure to report Medicaid breaches directly to the CMS hampers the agency’s ability to monitor data security issues nationally. This can make it harder to identify multi-state data breaches and determine when best practices and guidance need to be issued to correct common data security issues.

To correct the problem, OIG has recommended CMS should issue updated guidance for Medicaid agencies and their contractors and detail the circumstances that warrant a separate breach notification to be issued to the CMS.

CMS concurred with the recommendation, although did point out that the reporting requirements had been made clear in a 2006 State Medicaid Director Letter to Medicaid agencies and contractors.

The OIG report can be downloaded on this link (PDF, 2.1MB)

The post OIG Publishes 2016 Medicaid Data Breach Report appeared first on HIPAA Journal.

1.25 Million Records Exposed in Employees Retirement System of Texas Data Breach

Posted by HIPAA Journal

The Employees Retirement System of Texas (ERS) has discovered a flaw in its ERS OnLine portal allowed certain individuals to view information of other members after logging into the portal.

ERS explained that a coding error, introduced on January 1, 2018, affected the “Annual Out-of-Pocket Premium” function of its ERS OnLine system. The function is used by some retirees, direct-pay members, employees on leave without pay and COBRA participants. The function “allows participants who pay their Texas Employees Group Benefits Program (GBP) premiums with after-tax dollars to see their own premium payment information.” However, the flaw meant that certain ERS members were displayed information about other members and in some cases, certain beneficiaries – if those beneficiaries had received some form of payment from ERS and had information in the ERS OnLine system.

ERS notes that the coding error only returned other members’ information when individuals performed a modified search via the affected function and therefore it is “very unlikely” than most members information was accessed by other members. Since the function could only be used after logging in, and was only available to a limited group of individuals, the breach was limited in scale. Information was not exposed to the public at any point and its system was not hacked.

As a result of the error, the following information could potentially have been disclosed to other individuals: First and last names, Social Security numbers, and ERS member identification numbers (EmplIDs).

The security issue was discovered by ERS on August 17, 2018 when an ERS member raised the alert after a modified search returned the names, ERS ID numbers, and Social Security numbers of 50 other members. ERS immediately shut down the ERS OnLine system while the flaw was identified and corrected. The system was brought back online rapidly with the flawed search function disabled. ERS notes that the 50 members whose information was accessed were notified promptly.

ERS conducted a thorough investigation of the issue to determine if any other functions were affected, with assistance provided by third-party experts. ERS reports that the flaw was limited to the single function. Further controls on code design and code reviews have now been implemented to prevent any similar errors from resulting in the exposure of sensitive information in the future.

All affected members have been notified by mail and have been automatically enrolled in identity restoration services through Experian, which will be provided for one year without charge.

The security incident has now been reported to the Department of Health and Human Services’ Office for Civil Rights. The breach summary indicates up to 1,248,263 individuals have potentially been affected by the breach.

The post 1.25 Million Records Exposed in Employees Retirement System of Texas Data Breach appeared first on HIPAA Journal.

Ransomware Attack Impacts 16,000 National Ambulatory Hernia Institute Patients

Posted by HIPAA Journal

On September 13, 2018, the National Ambulatory Hernia Institute in California experienced a ransomware attack that resulted in certain files on its network being encrypted.

According to the breach notice uploaded to the healthcare provider’s website, the attackers were potentially able to gain access to demographic data of patients recorded prior to July 19, 2018.

In total, 15,974 patients have had some of their protected health information exposed as a result of the attack. The information potentially accessed by the attackers was limited to names, addresses, birth dates, diagnoses, appointment dates and times, and Social Security numbers. Patients who visited National Ambulatory Hernia Institute facilities for the first time after July 19, 2018 were unaffected by the breach.

Due to the sensitive nature of the exposed information, the National Ambulatory Hernia Institute has advised affected patients to obtain identity monitoring services for a period of at least one year. The breach notice does not state whether those services are being provided to patients free of charge.

The National Ambulatory Hernia Institute explained that all data have now been transferred to an off-site server and additional controls have been purchased and implemented to prevent further attacks, including a more robust firewall and antivirus software solutions. The investigation into the breach is ongoing.

The National Ambulatory Hernia Institute did not state what type of ransomware was used in the attack, only that “the attack was tied to an email address glynnaddey@aol.com.”

That email address has previously been associated with a variant of CrySiS/Dharma ransomware called gamma. Gamma ransomware ransoms are not fixed and are not stated on the ransom demands. Victims must email the attackers to find out how much it will cost for the keys to unlock files. No mention was made about whether the ransom demand was paid to regain access to data.

The post Ransomware Attack Impacts 16,000 National Ambulatory Hernia Institute Patients appeared first on HIPAA Journal.

$16 Million Anthem HIPAA Breach Settlement Takes OCR HIPAA Penalties Past $100 Million Mark

Posted by HIPAA Journal

OCR has announced that an Anthem HIPAA breach settlement has been reached to resolve potential HIPAA violations discovered during the investigation of its colossal 2015 data breach that saw the records of 78.8 million of its members stolen by cybercriminals.

Anthem has agreed to pay OCR $16 million and will undertake a robust corrective action plan to address the compliance issues discovered by OCR during the investigation.

The previous largest ever HIPAA breach settlement was $5.55 million, which was agreed with Advocate Health Care in 2016. “The largest health data breach in U.S. history fully merits the largest HIPAA settlement in history,” said OCR Director Roger Severino.

Anthem Inc., an independent licensee of the Blue Cross and Blue Shield Association, is America’s second largest health insurer. In January 2015, Anthem discovered cybercriminals had breached its defenses and had gained access to its systems and members’ sensitive data. With assistance from cybersecurity firm Mandiant, Anthem determined this was an advanced persistent threat attack – a continuous and targeted cyberattack conducted with the sole purpose of silently stealing sensitive data.

The attackers first gained access to its IT systems on December 2, 2014, with access continuing until January 27, 2015. During that time the attackers stole the data of 78.8 million plan members, including names, addresses, dates of birth, medical identification numbers, employment information, email addresses, and Social Security numbers.

The attackers gained a foothold in its network through spear phishing emails sent to one of its subsidiaries. They were then able to move laterally through its network to gain access to plan members’ data.

Anthem reported the data breach to OCR on March 13, 2015; however, by that time OCR was already a month into a compliance review of Anthem Inc. OCR took prompt action after Anthem uploaded a breach notice to its website and media reports started to appear indicating the colossal scale of the breach.

The OCR investigation uncovered multiple potential violations of HIPAA Rules. Anthem chose to settle the HIPAA violation case with no admission of liability.

OCR’s alleged HIPAA violations were:

  • 45 C.F.R. § 164.308(u)(1)(ii)(A) – A failure to conduct a comprehensive, organization-wide risk analysis to identify potential risks to the confidentiality, integrity, and availability of ePHI.
  • 45 C.F.R. § 164.308(a)(1)(ii)(D) – The failure to implement regularly review records of information system activity.
  • 45 C.F.R. § 164.308 (a)(6)(ii) – Failures relating to the requirement to identify and respond to detections of a security incident leading to a breach.
  • 45 C.F.R. § 164.312(a) – The failure to implement sufficient technical policies and procedures for electronic information systems that maintain ePHI and to only allow authorized persons/software programs to access that ePHI.
  • 45 C.F.R. § 164.502(a) – The failure to prevent the unauthorized accessing of the ePHI of 78.8 million individuals that was maintained in its data warehouse.

“Unfortunately, Anthem failed to implement appropriate measures for detecting hackers who had gained access to their system to harvest passwords and steal people’s private information,” said Roger Severino. “We know that large health care entities are attractive targets for hackers, which is why they are expected to have strong password policies and to monitor and respond to security incidents in a timely fashion or risk enforcement by OCR.”

In addition to the OCR HIPAA settlement, Anthem has also paid damages to victims of the breach. Anthem chose to settle a class action lawsuit filed on behalf of 19.1 million customers whose sensitive information was stolen. Anthem agreed to settle the lawsuit of $115 million.

2018 OCR HIPAA Settlements and Civil Monetary Penalties

Given the size of the Anthem HIPAA settlement it is no surprise that 2018 has seen OCR smash its previous record for financial penalties for HIPAA violations. The latest settlement takes OCR HIPAA penalties past the $100 million mark.

There have not been as many HIPAA penalties in 2018 than 2016(13), although this year has seen $1.4 million more raised in penalties than the previous record year and there are still 10 weeks left of 2018. The total is likely to rise further still.

OCR Financial Penalties for HIPAA Violations (2008-2018)

Year Settlements and CMPs Total Fines
2018 1 $24,947,000
2017 1 $19,393,000
2016 2 $23,505,300
2015 3 $6,193,400
2014 5 $7,940,220
2013 5 $3,740,780
2012 6 $4,850,000
2011 6 $6,165,500
2010 13 $1,035,000
2009 10 $2,250,000
2008 7 $100,000
Total 59 $100,120,200

 

HIPAA Fines and CMPs

Largest Ever Penalties for HIPAA Violations

Year Covered Entity Amount Settlement/CMP
2018 Anthem Inc $16,000,000 Settlement
2016 Advocate Health Care Network $5,550,000 Settlement
2017 Memorial Healthcare System $5,500,000 Settlement
2014 New York and Presbyterian Hospital and Columbia University $4,800,000 Settlement
2018 University of Texas MD Anderson Cancer Center $4,34,8000 Civil Monetary Penalty
2011 Cignet Health of Prince George’s County $4,300,000 Civil Monetary Penalty
2016 Feinstein Institute for Medical Research $3,900,000 Settlement
2018 Fresenius Medical Care North America $3,500,000 Settlement
2015 Triple S Management Corporation $3,500,000 Settlement
2017 Children’s Medical Center of Dallas $3,200,000 Civil Monetary Penalty

The post $16 Million Anthem HIPAA Breach Settlement Takes OCR HIPAA Penalties Past $100 Million Mark appeared first on HIPAA Journal.

Email Accounts Compromised at Biomarin Pharmaceutical and Envision Healthcare Corporation

Posted by HIPAA Journal

Novato, CA-based Biomarin Pharmaceutical has discovered two employee email accounts have been compromised as a result of a phishing attack in which a temporary employee’s login credentials were obtained by the attacker.

The attack was discovered on June 21, 2018 and immediate action was taken to prevent further unauthorized account access. The investigation into the breach determined that the email accounts had been accessed by an unauthorized individual, but it was not possible to tell whether any emails were opened or copied by the attacker.

An analysis of the compromised accounts suggests a document containing names, health insurance information and Social Security numbers may have been in one or both email accounts at the time the breach.

Due to the nature of exposed data, affected individuals have been advised to place a fraud alert on their credit files as a precaution against identity theft and fraud and urged to monitor explanation of benefits statements from insurers for medical services which have not been received.

Biomarin Pharmaceutical has now secured its network and has taken steps to prevent further email account breaches.

Envision Healthcare Corporation Email Accounts Compromised

Portland, OR-based Envision Healthcare Corporation is notifying current and former providers, affiliates, and job applicants that some of their personal information may have been compromised. The information was contained in email accounts which have recently found to have been accessed by an unauthorized individual.

The email accounts were accessed by a third party in July 2018 and contained information such as names, birth dates, Social Security numbers, driver’s license numbers and financial information. To data, no evidence has been uncovered to suggest any information has been stolen and misused, although as a precaution against identity theft and fraud, affected individuals have been offered complimentary identity theft and credit monitoring services through Experian IdentityWorks’ Credit 3B service.

Envision Healthcare Corporation has already taken steps to secure its systems and is evaluating the implementation of multi-factor authentication.

The post Email Accounts Compromised at Biomarin Pharmaceutical and Envision Healthcare Corporation appeared first on HIPAA Journal.

Minnesota DHS Notifies 21,000 Patients That Their PHI Has Potentially Been Compromised

Posted by HIPAA Journal

This week, the Minnesota Department of Human Services has mailed letters to approximately 21,000 individuals on medical assistance to alert them to a possible breach of their protected health information (PHI) due to two recent phishing campaigns.

Two DHS employees’ email accounts have been confirmed as having been compromised as a result of the employees clicking on links in phishing emails. The investigation into the breach determined that the attackers accessed both email accounts although it was not possible to determine which, if any, emails in the account had been accessed or copied by the attackers.

Minnesota DHS has reason to believe that other employees may also have been targeted and could also have clicked on links in phishing emails, but it has not yet been confirmed whether their accounts have been breached. The investigation into the phishing attacks is ongoing.

The two email account breaches occurred on June 28 and July 9, 2018, although the IT department only determined that the accounts had been breached in August. Upon discovery of the phishing attack, both accounts were secured to prevent further access.

It has taken a considerable amount of time to conduct the investigation and determine which patients have been affected. That process required every single email in each account to be checked for patient information, hence the delay in issuing breach notification letters.

Most of the individuals affected by the breach had previously interacted with the State Medical Review Team, although some individuals who had received services from Minnesota DHS Direct Care and Treatment facilities also had some of their PHI exposed.

The PHI in the compromised email accounts included full names, addresses, telephone numbers, birth dates, Social Security numbers, educational records, medical information, employment information, and financial information.

“We immediately took steps to secure these accounts, and currently have no evidence that any information was actually viewed, downloaded or misused,” explained Minnesota DHS in a statement about the breach. “We take data privacy very seriously at DHS, and continue to work with our employees and partners to prevent cyberattacks.”

The post Minnesota DHS Notifies 21,000 Patients That Their PHI Has Potentially Been Compromised appeared first on HIPAA Journal.

Michigan Medicine Notifies 3,600 Patients of PHI Disclosure Due to Mailing Error

Posted by HIPAA Journal

Michigan Medicine is notifying more than 3,600 patients of an impermissible disclosure of a limited amount of their protected health information.

In early September 2018, the Michigan Medicine Development Office launched a fundraising campaign that involved sending letters to a large number of its patients. A third-party vendor was contracted to print the letters for the mailing and while many of the letters were printed correctly, an error was made by the printing company that resulted in an impermissible disclosure of certain patients’ personal information.

According to Michigan Medicine, the error was introduced when the printing company installed new software. As a result of the error, a proportion of the letters contained information that was intended for other Michigan Medicine patients and did not match the name and address on the outside of the envelope.

Since this was a fundraising mailing, the letters did not contain any medical information, Social Security numbers, financial data, or other highly sensitive information. Patients affected by the error has their name, address, and in some cases email address and contact telephone number, disclosed to another Michigan Medicine patient.

The error was detected by Michigan Medicine on September 4, 2018 and prompt action was taken to alert the vendor to the error to prevent any further impermissible disclosures of patient information.

“Patient privacy is extremely important to us, and we take this matter very seriously,” said Jeanne Strickland, Michigan Medicine chief compliance officer. “Michigan Medicine took steps immediately to investigate this matter.”

As an additional measure to prevent similar breaches, Michigan Medicine’s Development Office will be using window envelopes for future mailings, eliminating the need to match envelopes with letters.

The Mailing error was a reportable breach under HIPAA and the Department of Health and Human Services’ Office for Civil Rights (OCR) was notified well inside the 60-day reporting deadline. The breach summary on the OCR website indicates 3,624 patients were affected by the incident.

The post Michigan Medicine Notifies 3,600 Patients of PHI Disclosure Due to Mailing Error appeared first on HIPAA Journal.

California HIV Patient PHI Breach Lawsuit Allowed to Move Forward

Posted by HIPAA Journal

A lawsuit filed by Lambda Legal on behalf of a victim of a data breach that saw the highly sensitive protected health information of 93 lower-income HIV positive individuals stolen by unauthorized individuals has survived a motion to dismiss.

The former administrator of the California AIDS Drug Assistance Program (ADAP), A.J. Boggs & Company, submitted a motion to dismiss but it was recently rejected by the Superior Court of California in San Francisco.

In the lawsuit, Lambda Legal alleges A.J. Boggs & Company violated the California AIDS Public Health Records Confidentiality Act, the California Confidentiality of Medical Information Act, and other state medical privacy laws by failing to ensure an online system was secure prior to implementing that system and allowing patients to enter sensitive information.

A.J. Boggs & Company made its new online enrollment system live on July 1, 2016, even though it had previously received several warnings from nonprofits and the LA County Department of Health that the system had not been tested for vulnerabilities.

It was alleged that the failure to ensure its system was secure meant that any information entered in the portal by patients was at risk of exposure and could potentially be obtained by unauthorized individuals. In November 2016, four months after the system went live, A.J. Boggs & Company took the system offline to correct the flaws.

However, in February 2017, the California Department of Health discovered that the flaws in its portal had been exploited and unauthorized individuals had gained access to the system and had downloaded the private and highly sensitive information of 93 patients with HIV or AIDS. Following the discovery, the contract with the firm was cancelled and a new state-run system was adopted.

The ADAP program provides states with federal funding to provide financial assistance to low-income individuals with HIV or AIDS to make HIV medications more affordable, extending access to Medicaid when patients earned too much. Any medical data breach is serious, although the disclosure of an individual’s HIV status is especially so.

“HIV is still a highly stigmatized medical condition,” said Scott Schoettes, HIV Project Director at Lambda Legal. “When members of already vulnerable communities — transgender people, women, people of color, undocumented people, individuals with low incomes — already face challenges in accessing health care, undermining the trust they have in the ADAP is not just a breach of security; it creates a barrier to care.”

Lambda Legal is seeking statutory and compensatory damages for the patient and is seeking class action status to allow the other 92 breach victims to be included in the lawsuit.

The post California HIV Patient PHI Breach Lawsuit Allowed to Move Forward appeared first on HIPAA Journal.

PHI of 37,000 Gold Coast Health Plan Members Potentially Compromised

Posted by HIPAA Journal

Camarillo, CA-based Gold Coast Health Plan is informing approximately 37,000 plan members that some of their protected health information has potentially been obtained by hackers who succeeded in compromising the email account of one of its employees.

The employee was fooled by a phishing email and responded disclosing login credentials to the email account. The attackers gained access to the email account on June 18, 2018 and access remained possible until August 1, 2018. Gold Coast Health Plan discovered the security breach on August 8 and took steps to secure the account and prevent any further remote access.

A leading third-party cybersecurity firm was engaged to conduct an investigation into the breach and assess the scope of the incident and determine whether any patients’ health information was accessed. It was not possible to rule out PHI access and data theft with 100% certainty, although no reports have been received to date that suggest any PHI in the account has been misused.

Gold Coast Health Plan believes the attack was financially motivated and the purpose of the attackers was to gain access to banking information in order to make fraudulent transfers from Gold Coast Health Plan accounts rather than to steal plan members’ data.

The investigation confirmed that the compromised account contained claims data, health plan ID numbers, and the dates medical services had been received by plan members. Some individuals also had their name, birthdate, and/or medical procedure codes exposed. The types of information exposed varied for each patient with many patients only having one or two of the above data elements exposed.

Even though Social Security numbers and financial information was not exposed, Gold Coast Health Plan is offering breach victims a MyIDCare subscription and identity theft protection services through ID Experts without charge.

The breach has prompted Gold Coast Health Plan to implement further security controls to prevent similar breaches from occurring in the future. Those measures include enhanced end user training on security with a specific focus on phishing, increased monitoring of email accounts, and enhancements to email security controls.

The post PHI of 37,000 Gold Coast Health Plan Members Potentially Compromised appeared first on HIPAA Journal.