Texas-based First Care Health Plans is notifying more than 8,000 plan members that some of their personal information may have been impermissibly disclosed as a result of automated reports being accidentally emailed to an incorrect recipient.

The daily reports were automatically generated and sent to an email distribution list. The reports contained medical requests which included members’ names, member ID numbers, procedure codes, descriptions of treatments, authorization numbers, and names of treating providers.

On August 15, 2018, the FirstCare IT security team became aware that the reports had been sent to an external email address in error and the emails had not been encrypted. An investigation into the incident revealed the reports had been sent over a period of 17 months, starting on March 22, 2017. The reports contained the protected health information of 8,056 plan members.

FirstCare explained in its breach notice that various security solutions had been deployed to monitor for unauthorized access, acquisition, and unauthorized use of ePHI, but they had failed to identify the misdirected emails.

Upon discovery of the error, the incorrect recipient was removed from the distribution list and a full review was conducted of all other automated reports to ensure similar errors had not been made. FirstCare has now developed a new protocol to ensure the recipients of active reports are regularly monitored and new auditing parameters have been implemented related to change controls.

FirstCare has taken several steps to contact the user of the email account and secure the ePHI. Emails were sent to the account in an attempt to get the user to make contact, but those attempts failed.  FirstCare also engaged the U.S Federal Government to investigate and help identify the owner of the email account to minimize the potential for harm.

“We have not received any indication that the information has been accessed or used by an unauthorized individual,” explained FirstCare in its substitute breach notice. Since it is not possible to confirm whether there has been an impermissible disclosure of ePHI, FirstCare is offering to reimburse all affected patients for one year of credit monitoring services through LifeLock.

The post Email Error Exposed the PHI of 8,000 Members of FirstCare Health Plans appeared first on HIPAA Journal.

Children’s Hospital of Philadelphia (CHOP) has discovered the email accounts of two employees have been compromised following successful phishing attacks on August 23 and August 29, 2018.

On August 24, CHOP discovered an unauthorized individual had gained access to the email account of a one of its physicians. The investigation revealed the account was first accessed the previous day. Two weeks later, on September 6, CHOP discovered a second email account had also been compromised. In that case, access to the account was first gained on August 29. In both cases, prompt action was taken to secure the accounts and prevent further access. A leading computer forensics firm was also retained to assist with the investigation and assess the scope of the breach.

An analysis of the email accounts revealed the individual(s) behind the phishing attacks may have been able to gain access to the protected health information (PHI) of a limited number of patients of CHOP’s neonatal and fetal programs. The information that was exposed differs from patient to patient and may have included a full name, birth date, and clinical information related to neonatal/fetal services received at Children’s Hospital of Philadelphia and, in a limited number of cases, the Hospital of the University of Philadelphia. No Social Security numbers or financial information were compromised at any point.

While emails in the account were potentially accessed and ePHI may have been stolen, CHOP has not uncovered any evidence to suggest that patient information has been misused.

Mothers and parents/legal guardians of current and former patients were notified of the breach by mail on October 23, 2018. Affected individuals have been advised to monitor statements from their healthcare providers for any signs of fraudulent activity.

CHOP has not yet disclosed how many individuals have been affected. The phishing incidents have yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal.

The post Phishing Attack on Children’s Hospital of Philadelphia Results in Double Account Breach appeared first on HIPAA Journal.

On September 13, 2018, the National Ambulatory Hernia Institute in California experienced a ransomware attack that resulted in certain files on its network being encrypted.

According to the breach notice uploaded to the healthcare provider’s website, the attackers were potentially able to gain access to demographic data of patients recorded prior to July 19, 2018.

In total, 15,974 patients have had some of their protected health information exposed as a result of the attack. The information potentially accessed by the attackers was limited to names, addresses, birth dates, diagnoses, appointment dates and times, and Social Security numbers. Patients who visited National Ambulatory Hernia Institute facilities for the first time after July 19, 2018 were unaffected by the breach.

Due to the sensitive nature of the exposed information, the National Ambulatory Hernia Institute has advised affected patients to obtain identity monitoring services for a period of at least one year. The breach notice does not state whether those services are being provided to patients free of charge.

The National Ambulatory Hernia Institute explained that all data have now been transferred to an off-site server and additional controls have been purchased and implemented to prevent further attacks, including a more robust firewall and antivirus software solutions. The investigation into the breach is ongoing.

The National Ambulatory Hernia Institute did not state what type of ransomware was used in the attack, only that “the attack was tied to an email address glynnaddey@aol.com.”

That email address has previously been associated with a variant of CrySiS/Dharma ransomware called gamma. Gamma ransomware ransoms are not fixed and are not stated on the ransom demands. Victims must email the attackers to find out how much it will cost for the keys to unlock files. No mention was made about whether the ransom demand was paid to regain access to data.

The post Ransomware Attack Impacts 16,000 National Ambulatory Hernia Institute Patients appeared first on HIPAA Journal.

Novato, CA-based Biomarin Pharmaceutical has discovered two employee email accounts have been compromised as a result of a phishing attack in which a temporary employee’s login credentials were obtained by the attacker.

The attack was discovered on June 21, 2018 and immediate action was taken to prevent further unauthorized account access. The investigation into the breach determined that the email accounts had been accessed by an unauthorized individual, but it was not possible to tell whether any emails were opened or copied by the attacker.

An analysis of the compromised accounts suggests a document containing names, health insurance information and Social Security numbers may have been in one or both email accounts at the time the breach.

Due to the nature of exposed data, affected individuals have been advised to place a fraud alert on their credit files as a precaution against identity theft and fraud and urged to monitor explanation of benefits statements from insurers for medical services which have not been received.

Biomarin Pharmaceutical has now secured its network and has taken steps to prevent further email account breaches.

Envision Healthcare Corporation Email Accounts Compromised

Portland, OR-based Envision Healthcare Corporation is notifying current and former providers, affiliates, and job applicants that some of their personal information may have been compromised. The information was contained in email accounts which have recently found to have been accessed by an unauthorized individual.

The email accounts were accessed by a third party in July 2018 and contained information such as names, birth dates, Social Security numbers, driver’s license numbers and financial information. To data, no evidence has been uncovered to suggest any information has been stolen and misused, although as a precaution against identity theft and fraud, affected individuals have been offered complimentary identity theft and credit monitoring services through Experian IdentityWorks’ Credit 3B service.

Envision Healthcare Corporation has already taken steps to secure its systems and is evaluating the implementation of multi-factor authentication.

The post Email Accounts Compromised at Biomarin Pharmaceutical and Envision Healthcare Corporation appeared first on HIPAA Journal.