Upstate University Hospital in Syracuse, NY, is notifying 1,216 patients that some of their protected health information (PHI) has been impermissibly accessed by a former employee.

Upstate University Hospital discovered the breach on September 12, 2018, which prompted a full investigation to determine which patients had had their privacy violated. The investigation revealed that the former employee first accessed patient health records without any legitimate work reason for doing so on November 3, 2016. Patient records continued to be accessed until October 23, 2017.

The investigation did not uncover any evidence to suggest any information had been printed, copied, or forwarded outside the organization.

It is unclear why the former employee accessed the records. No information on the motives behind the privacy violations has been made public.

Highly sensitive information such as Social Security numbers, financial information, health insurance information and other information typically sought by identity thieves were not compromised and remained secure at all times.

The breach was limited to names, ages, addresses, medical record numbers, dates of service, types of services received, diagnoses, treatment information, and details of prescriptions.

All staff members at the hospital with access to PHI already receive in-depth training on maintaining the privacy and security of patient information and are aware of their responsibilities with respect to HIPAA.

The privacy breach has prompted Upstate University Hospital to conduct a review of safeguards to keep patient health information private and confidential and those safeguards have now been strengthened.

The post 1,216 Patient Records Impermissibly Accessed by Former Upstate University Hospital Employee appeared first on HIPAA Journal.

Falls Church, VA-based Inova Health System has started notifying 12,331 patients that some of their protected health information has been accessed by an unauthorized individual.

Inova Health System was contacted by law enforcement on September 5, 2018 over a suspected breach of patients’ billing information. A leading computer forensics firm was engaged to conduct an investigation into the breach to determine the nature of the attack and the extent of the breach.

The investigation revealed its billing system was first accessed by an unauthorized individual in January 2017, and again between July and October 2017. Access was gained using the login credentials of an Inova employee.

Peculiarly, Inova also reported that the same individual also gained access to paper billing records of a small number of patients in December 2016, which suggests that this may have been an insider breach involving a former employee, business associate or another individual with access to Inova facilities. However, no information about the individual responsible for the breach has been made public by Inova.

The types of information that were accessed included patient names, addresses, birth dates, medical record numbers, and Social Security numbers. Treatment information of a limited number of patients was also potentially accessed.

The data breach has prompted Inova to enhance its security processes. Additional monitoring tools have been deployed to identify unauthorized access, password policies have been updated with respect to password complexity, and new limitations on the transmission of information have been implemented. Employees have been retrained on securing sensitive information before leaving their workstations unattended and on password security. A review of security policies and procedures has also been conducted.

Inova started mailing breach notification letters to affected patients on November 2 and is assisting law enforcement with its investigation.

All patients affected by the breach have been offered one year of credit monitoring and identity theft protection services without charge.

The post Billing Records of 12,331 Patients of Inova Health System Have Been Compromised appeared first on HIPAA Journal.

Altus Hospital in Baytown, TX, has experienced a ransomware attack that resulted in the encryption of many hospital records.

The electronic medical record system was not affected, although some of the encrypted files contained patients’ protected health information including names, home addresses, contact telephone numbers, birth dates, Social Security numbers, credit card information, driver’s license numbers, and medical information.

The attack was discovered on September 3, 2018. Altus Hospital received a ransom demand; however, assisted by a third-party security consultant, Altus Hospital was able to restore all affected files from backups.

The investigator determined that the attacker gained access to the hospital’s servers before deploying a Dharma ransomware variant. Altus Hospital believes the aim of the attack was solely to extort money from the hospital. Data access and theft of patient information is not believed to have occurred.

While the attack was limited to Baytown hospital servers, some of the information stored on those servers came from the following affiliated entities: Altus Women’s Center of Baytown, LP, LP, Clarus Imaging (Baytown), Oprex Surgery (Baytown), LP, Clarus Imaging (Beaumont), LP, Altus Radiation Oncology Baytown, LP, and Zerenity Baytown, LP.

Altus Hospital has retained external risk and security consultants who are helping to make improvements to the hospital’s cybersecurity defenses.

PHI of 2,393 Patients of Southwest Washington Regional Surgery Center Compromised

Southwest Washington Regional Surgery Center has discovered an unauthorized individual has gained access to the email account of one of its employees as a result of a phishing attack.

The email account was breached on May 27, 2018 and access continued until August 13, 2018. Following an extensive forensic investigation of the breach and a manual review of all emails in the compromised account, Southwest Washington Regional Surgery Center determined on September 25 that the email account contained the protected health information of 2,393 of its patients.

The types of information that may have been accessed differed from patient to patient and may have included names, driver’s license numbers, Social Security numbers, diagnoses, treatment information, details of surgical procedures performed, prescribed medications, lab test results, and health insurance information. Some patients’ credit card numbers have also potentially been compromised.

Credit monitoring and identity theft restoration services are being offered to all patients whose Social Security number or driver’s license number were potentially accessed by the attacker.

Southwest Washington Regional Surgery Center has updated passwords and improved email access protocols to prevent further phishing attacks.

The post Altus Hospital Baytown Suffers Dharma Ransomware Attack appeared first on HIPAA Journal.

The Chicago-based health insurer Bankers Life, a division of CNO Financial Group Inc., has discovered hackers gained access to its systems and potentially stole the personal information of more than half a million individuals.

Bankers Life provides a range of insurance services to customers, including life insurance, long term care insurance, health insurance, and Medicare supplemental insurance and is the largest division of CNO Financial Group.

Hackers first gained access to its systems between May 30 and September 13, 2013. Bankers Life said it discovered the breach on August 7, 2018.

The hackers gained access to a range of sensitive personal information of a ‘limited number’ of its employees. A ‘limited group’ of customers had names, Social Security numbers, driver’s license numbers, bank account numbers, state identification numbers, medication information, diagnoses, and treatment information exposed. The protected health information of a much larger group of customers was also potentially accessed by the hackers. For that group, names, addresses, dates of birth, insurance policy numbers, insurance type, premium amounts, dates of service, claim amounts, and the last four digits of Social Security numbers were potentially stolen.

Bankers Life hired a third-party computer forensics investigator to conduct an investigation into the breach to determine how access was gained to its systems and the extent of the breach. The details of how the hackers gained access to its systems has not been publicly disclosed.

Bankers Life has now taken steps to restrict access to its systems, monitoring has been enhanced, and additional security procedures have now been implemented to prevent further breaches.

The disclosure of the breach was delayed at the request of federal investigators. Affected customers are now being notified and have been offered free identity theft repair and credit monitoring services.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 566,217 customers have been affected by the breach.

The Bankers Life data breach is the fifth largest healthcare data breach to be reported in 2018.

The post 566,217 Customers of Chicago-Based Health Insurer Impacted by Data Breach appeared first on HIPAA Journal.

Approximately 10,000 patients of Raley’s Pharmacy are being notified that some of their protected health information (PHI) has potentially been compromised.

On September 24, 2018, a laptop computer was stolen from a Raley’s pharmacy that may have contained some patients’ PHI.

Raley’s pharmacy immediately launched an investigation to determine what information was stored on the device. Interviews were conducted with staff members who had used the device in an attempt to understand the types of content that may have been exposed. The email accounts of employees were also checked for attachments and links to documents that contained ePHI, to determine which files had been downloaded or were stored in cache files in a temporary directory on the laptop.

After careful analysis, Raley’s Pharmacy was able to determine that the only patients affected by the security incident were those that had visited a Raley’s, Bel Air, and Nob Hill Foods pharmacy between January 1, 2017 and September 24, 2018 to have prescriptions filled.

An analysis of the files which had potentially been downloaded to the laptop confirmed that highly sensitive information such as Social Security numbers, addresses, credit card information, and driver’s license numbers had not been compromised. The breach was limited to first and last names, gender, dates of birth, visit dates, pharmacy location visited, medical condition, prescription information, and health plan ID numbers.

Since Health plan/insurance information has potentially been exposed, affected patients have been advised to monitor their Explanation of Benefits statements for any sign of fraudulent activity.

The security incident has prompted Raley’s Pharmacy to implement encryption on all laptops to prevent data access by unauthorized individuals should further theft incidents occur. Additional security controls are also being evaluated.

The post Stolen Raley’s Pharmacy Laptop May Have Contained PHI of 10,000 Patients appeared first on HIPAA Journal.

The protected health information of up to 40,000 patients of the Jones Eye Clinic and its affiliated surgery center, CJ Elmwood Partners, L.P, in Sioux City, IA has potentially been compromised.

The breach is the result of a ransomware attack which affected data stored in an information system used for scheduling appointments and billing patients. Electronic medical records were unaffected as they were housed in a separate system which was not accessed by the attacker.

Jones Eye Clinic discovered the ransomware attack on August 23, 2018, although an investigation by a third-party forensic investigator revealed that the attacker gained access to its system and installed the ransomware on the evening of August 22.

A ransom was demanded for the keys to decrypt the files; however, no payment was made as it was possible to recover the files from backups. A full data restoration was completed on August 23.

The investigation into the ransomware attack did not uncover any evidence to suggest that the attacker viewed or obtained patient data, although since data theft could not be ruled out, all affected patients have been offered free credit monitoring services for 12 months. Patients have been notified of the data breach by mail and have up to January 19, 2019 to enroll for credit monitoring services.

The information potentially accessed was limited to full names, dates of birth, addresses, medical record numbers, dates of service, and general descriptions of surgical procedures and clinic visits. Some patients may also have had their insurance status, Social Security number, and claims information exposed. Jones Eye Clinic does not believe financial information was accessed or exposed.

The breach potentially affects all patients of the eye clinic and surgery center who registered or received medical services between January 1, 2003 and August 23, 2018.

The post PHI of 40,000 Patients of Sioux City Eye Clinic Potentially Compromised appeared first on HIPAA Journal.

On August 13, 2018, Catawba Valley Medical Center (CVMC) in Hickory, NC discovered an unauthorised individual accessed the email account of a CVMC employee. Upon discovery of the email breach, steps were taken to secure the account and prevent further access and a third-party computer forensics firm was called in to assist with the investigation and determine the extent of the breach.

That investigation revealed that between July 4 and August 17, 2018, three employees’ email accounts had been compromised after the employees responded to phishing emails. Some of the emails in those accounts contained patients’ protected health information including names, dates of birth, details of medical services received at CVMC, health insurance details, and for certain patients, Social Security numbers.

No evidence was found to suggest that any emails had been accessed or copied and no information has been received to suggest patient health information has been misused in any way.

The phishing incidents have prompted CVMC to hire security experts to enhance employee education, more robust email security controls have been implemented, and CVMC will continue to upgrade hardware and software as appropriate to repel malicious threats.

All patients whose protected health information may have been compromised as a result of the email account breaches were notified by mail on October 12, 2018.

The breach summary on the HHS’ Office for Civil Rights’ breach portal indicates up to 20,000 patients have potentially been affected by the email account breaches.

Byram Healthcare Alerts Patients to Insider Breach

Byram Healthcare, a provider of medical supplies, has been informed by law enforcement that a former employee has been accused of stealing the credit card information of patients.

Byram Healthcare investigated the incident and determined that the employee had access to personal information including names, addresses, dates of birth, limited health information, and credit card numbers, but not Social Security numbers. It is unclear at this stage how many patients have been affected.

Byram Healthcare has responded to the breach by providing further training to staff on privacy and security obligations and safeguarding patients’ protected health information. Monitoring of staff has also been increased.  Affected patients were notified by mail of the privacy violation and possible theft of PHI on October 22, 2018.

The post Catawba Valley Medical Center Phishing Attack Impacts 20,000 Patients appeared first on HIPAA Journal.