Paperwork containing the protected health information of approximately 1,800 patients has been discovered abandoned in a Midtown, Houston street by an employee of the CBS-affiliated television station KBOU 11.

The paperwork contained information such as patients’ names, birth dates, diagnoses, treatment information, medications, vital signs, and admission dates. KBOU launched an investigation into the breach and determined the paperwork related to patients from five Houston hospitals – MD Anderson Cancer Center, LBJ Hospital, Children’s Memorial Hermann, Memorial Hermann Hospital, and TIRR Memorial Hermann. The investigation led to UT Health.

According to the report, the records were stolen from the locked trunk of a vehicle belonging of a medical resident who, while studying at UTHealth’s McGovern Medical School, had worked at the above hospitals. The records were stolen from his vehicle in July.

Officials at UT Health confirmed to KBOU that they are aware of the breach. Reporters spoke to the medical graduate and confirmed that the incident had not been reported to the police until after he had been contacted by KBOU reporters.

A spokesperson for UTHealth issued a statement saying, “We promptly took steps to investigate the circumstances of the disclosure, which revealed that the stolen documents had been discarded on a city street and found a day later by an employee of KHOU-TV Channel 11.” The records were collected by that employee and were returned to UTHealth and have now been secured. UTHealth found no evidence to suggest that any information in the documents was viewed by unauthorized individuals.

It is unclear why the records were removed from the hospitals in the first place, why the theft was not reported to law enforcement immediately, and why the hospitals concerned had not been informed about the breach until after the records were discovered by KBOU. According to UTHealth, the affected hospitals will be issuing notifications to all affected patients in due course.

The post PHI of 1,800 Patients Found Abandoned in Houston Street appeared first on HIPAA Journal.

Aspire Health, a Nashville, TN-based provider of in-home services for patients diagnosed with serious illnesses, has experienced a phishing attack that resulted in the email account of an employee being accessed by an unauthorized individual.

Once access to the email account was gained, the attacker forwarded 124 emails to an external email account. Several of the forwarded email messages contained the protected health information of patients and “confidential and proprietary information and files”.

According to a statement issued by a spokesperson for Aspire Health, breach notification letters have already been sent to a “small handful” of its patients, although the exact number affected by the breach has not been disclosed. The data breach has yet to appear on the Department of Health and Human Services’ Office for Civil Rights’ breach portal.

As is the case with many phishing scams, an email was sent to the employee which contained a hyperlink to a website which requested login credentials. The website, created on August 28, 2018, is hosted in the Russian Federation and was accessed by the employee on or around September 3, 2018. The employee’s email account was breached on September 3. The website has since been marked as potentially malicious by Google.

Aspire Health has launched an internal investigation into the breach, is attempting to determine whether any of the forwarded PHI has been accessed and is trying to identify the individual responsible for the attack. Part of that process has involved filing a federal court motion to get Google to reveal more information about the hacker.

The email account to which the messages were forwarded is a Gmail account and Aspire Health believes that Google could provide vital information that could allow the hacker to be identified and also help to determine whether any of the forwarded messages have been opened. According to The Tennessean, Aspire Health made informal attempts to get Google to release information about the owner of the website and the subscriber to the email account but was advised that a subpoena would be required.

Should Aspire Health’s efforts prove successful, the attacker could be identified; however, bringing that individual to justice for the attack is likely to be a much more difficult task.

The post Protected Health Information Stolen in Aspire Health Phishing Attack appeared first on HIPAA Journal.

Ohio Living, a provider of life plan communities and home health services in Ohio, has discovered an unauthorized individual has gained access to the email accounts of some of its employees.

Ohio Living detected suspicious activity related to an employee’s email account on July 10, 2018. An investigation was immediately launched, and a third-party computer forensics expert was hired to investigate the breach and determine how access to the account was gained. On July 19, 2018, Ohio Living was informed that several email accounts had been compromised on July 10 and that those accounts had been accessed by an unauthorized individual.

It was not possible to determine whether any emails were opened or if any emails were downloaded by the attacker. A review of the compromised accounts revealed they contained the protected health information of 6,510 individuals.

Upon discovery of the breach, passwords were reset on all accounts known to have been compromised and a full password reset was performed on all other employees’ email accounts. Ohio Living has also provided further training to its employees to improve security awareness and prevent further email breaches in the future.

Ohio Living was informed on September 4, 2018, that the emails contained names, contact information, financial information, Social Security numbers, birth dates, medical record numbers, Patient ID numbers, clinical information, medical information, diagnosis and treatment information, and health insurance details. The information exposed varied for each patient.

No reports have been received to suggest any PHI has been misused, but out of an abundance of caution, all individuals affected have been offered complementary credit monitoring and identity theft protection services.

PHI of 1,100 Patients of Guardant Exposed in Phishing Attack

Guardiant, a Redwood City, CA-based liquid biopsy specialist, has discovered an unauthorized individual gained access to the email account of one of its employees. Access to the email account was gained as a result of the employee responding to a phishing email in July 2018.

An investigation into the breach revealed the attacker had access to the account for five days before the password was changed and access to the account was blocked. An analysis of the emails in the account revealed they contained the protected health information of approximately 1,100 patients.

The types of information potentially accessed was limited to patients’ names, contact details, dates of birth, medical codes, and for a small number of patients, Social Security numbers.

Tucson Medical Center Discovers Paper Files Containing PHI Were Left Unsecured

TMC Healthcare, which runs Tucson Medical Center in Arizona, has discovered that paper files containing the PHI of 1,776 patients were accidentally left unsecured in a suite used for storage. While the facility is usually locked and secured, on July 12, 2018, the door to the suite was discovered to be unlocked.

The suite was immediately secured to ensure files could not be accessed and an investigation was launched to determine how long files had been left unsecured, and which patients’ PHI had been exposed.

TMC Healthcare determined that the records were potentially accessible for a period of no more than 15 days. Files stored in the suite contained patients’ names, addresses, medical record numbers, dates of birth, insurance ID numbers, Social Security numbers, provider information, diagnoses, treatment information, medications, test results and other clinical information.

TMC Healthcare does not believe any files were accessed by unauthorized individuals during the time they were left unsecured.

Since the incident constitutes a data breach, all individuals potentially affected have been notified by mail and a breach report has been submitted to the HHS’ Office for Civil Rights.

Further training has now been given to the employees responsible for the secure storage and maintenance of files containing PHI. As a precaution against identity theft and fraud, all patients whose records were exposed have been offered credit monitoring and identity theft protection services for 12 months without charge.

The post Phishing Attack on Ohio Living Exposed PHI of 6,500 Individuals appeared first on HIPAA Journal.