A former employee of Arkansas Children’s Hospital is being investigated by law enforcement over the theft and misuse of patients’ protected health information. According to the breach notice submitted to the Department of Health and Human Services’ Office for Civil Rights, the former employee potentially viewed and copied the PHI of up to 4,521 patients.

That individual was employed at Arkansas Children’s Hospital for 15 months between November 7, 2016 and February 6, 2018. During that time the employee was provided with access to patient health information to perform essential functions of the job.

On May 9, 2018, law enforcement notified Arkansas Children’s Hospital that an investigation had been launched over the possible theft of patients’ Social Security numbers and personal information and the misuse of that information for personal gain.

Arkansas Children’s Hospital immediately launched an investigation to determine the types of information that were potentially accessed and whether patients’ PHI had been accessed without authorization. While that internal investigation confirmed the types of information that were potentially accessed, it was not possible to determine whether the information was accessed for work purposes or other reasons.

Consequently, the incident has been treated as a data breach and all patients have now been notified of the possible theft and misuse of their PHI. The types of information potentially stolen includes full names, dates of birth, addresses, contact telephone numbers, Social Security numbers, health insurance information, charge amounts, descriptions of services received, and some clinical information.

As a precaution against identity theft and fraud, all 4,521 patients have been offered complimentary credit monitoring and identity theft protection services for 12 months. Patients have been advised to monitor their credit reports, financial statements, and Explanation of Benefits statements for any sign of fraudulent activity.

The employee has been terminated and Arkansas Children’s Hospital has now implemented additional hiring controls and has retrained its employees on internal policies and procedures and HIPAA Rules covering the accessing of patient information.

The post Former Arkansas Children’s Hospital Employee Investigated Over Potential Theft of 4,500 Patients’ PHI appeared first on HIPAA Journal.

Manitowoc County in Wisconsin has announced protected health information has been stolen as a result of a successful phishing attack. The incident occurred on or around January 14, 2018, although the attack and data breach was not discovered until April 24. While the account was immediately secured to prevent any further access, the attacker had well over two months to view and obtain sensitive data stored in the email account.

During the time that the attacker had email account access, emails sent to that account were diverted to a different email account to which Manitowoc County staff had no access. While County officials have not uncovered any evidence to suggest any of the information in the emails has been misused, they have similarly not been able to establish that sensitive data have not been misused or sold on.

The types of information that were stolen include names, telephone numbers, email addresses, addresses, and dates of birth. Individuals who received services through the County have also had their health information, insurance information, details of prescriptions, client ID numbers, diagnoses, and other treatment related information stolen by the attacker.

Manitowoc County has not publicly disclosed how many individuals have been impacted and the incident has yet to be listed on the Department of Health and Human Services’ Office for Civil Right breach portal. However, Manitowoc County has now issued notifications to all individuals impacted by the phishing attack.

Breach victims have been warned that they should be alert to phishing emails that claim to be from Manitowoc County. County officials have confirmed that they will not send any emails or make calls to people impacted by this incident and request further personal information. Individuals impacted by the breach have also been told to be wary of any emails containing hyperlinks, to exercise caution opening any emails, and not to disclose sensitive information to individuals over the telephone.

The phishing attack has prompted the County to take further steps to enhance security controls and additional investments will be made in new protocols, technology and training to prevent further successful phishing attacks from occurring.

The post PHI Stolen As a Result of Manitowoc County Phishing Attack appeared first on HIPAA Journal.

Humana is notifying members in several states that their PHI has potentially been accessed during a ‘sophisticated’ spoofing attack.

A spoofing attack is an attempt by a threat actor or bot to gain access to a system or data using stolen or spoofed login credentials. Humana became aware of the attack on June 3, when large numbers of failed login attempts were detected from foreign IP addresses. Prompt action was taken to block the attack, with the foreign IP addresses blocked from accessing its Humana.com and Go365.com websites on June 4.

Humana suggests “the nature of the attack and observed behaviors indicated the attacker had a large database of user identifiers (IDs).” It is possible the login credentials are old and that they were obtained in a separate third-party breach, although Humana notes that “the excessive number of log in failures strongly suggests the ID and password combinations did not originate from Humana.”

The website accounts did not contain Social Security numbers or financial information; however, the following types of information could potentially have been accessed by the attackers: Details of medical, dental, and vision claims, provider name, dates of service, services performed, charge amounts, paid amounts, spending account information, balance information, wellness information, and biometric screening data.

Humana says it has not uncovered any evidence to suggest any members’ data were stolen in the attack; however, as a precaution, all members whose accounts could potentially have been accessed have been offered 12 months of credit monitoring and identity theft protection services through the Equifax Credit Watch Gold service. A password reset has been performed on all accounts.

Humana is currently deploying new controls to improve the security of its websites and has implemented a new system for alerts of successful and failed login attempts.

This attack could simply be a brute force attempt to gain access to users’ accounts with just a username obtained in a previous breach and a list of possible passwords. To reduce the potential for such an attack resulting in unauthorized account access, strong, complex passwords should be used for accounts that have not previously been used on any other account.

If possible, two-factor authentication should also be activated. This requires an additional piece of information – a code sent to a mobile phone for instance – to be entered when an unfamiliar device or IP attempts to gain access to an account.

The post Sophisticated Cyber Spoofing Attack Reported by Humana appeared first on HIPAA Journal.

The Alaska Department of Health and Social Services (ADHSS) is notifying ‘more than 500’ individuals that some of their protected health information (PHI) has potentially been accessed and stolen by hackers.

On April 26, the ADHSS discovered malware had been installed on an employee’s computer after suspicious behavior was detected. The investigation revealed malware had been installed – a variant of the Zeus/Zbot Trojan – which is known to be used to steal sensitive information.

The malware was discovered to have communicated with IP addresses in Russia, although it is not known whether the attackers are based in Russia or just using Russian IP addresses. ADHSS has not confirmed whether protected health information was exfiltrated to those IP addresses, although data access and theft of PHI is a possibility.

Under the Health Insurance Portability and Accountability Act, HIPAA-covered entities must report data breaches as soon as possible, but no later than 60 days following the discovery of a breach. AHDSS chose to delay the issuing of notifications until just before the deadline to allow investigators to determine the nature and extent of the breach.

The infected computer contained a range of documents that included sensitive information of individuals in the Northern region of Alaska. Patients affected by the breach had previously had dealings with the ADHSS division of Public Assistance (DPA) through the DPA Northern regional offices.

The types of information potentially stolen include first and last names, phone numbers, dates of birth, pregnancy status, death status, incarceration status, Medicaid/Medicare billing codes, Social Security numbers, driver’s license numbers, and other confidential information.

In its breach notice, ADHSS explained it had multiple layers of security in place to prevent malware infections, but in this instance those defenses had been bypassed.

Immediately after the virus was discovered the computer was taken offline to prevent any further data access. The ADHSS Information Technology and Security team is continuing to investigate the breach and will be implementing additional protections to prevent further breaches of this nature.

The post Zeus Trojan Infection Potentially Resulted in Theft of PHI from Alaska DHSS appeared first on HIPAA Journal.

This week, Associated Dermatology & Skin Cancer Clinic of Helena, MT, has disclosed a breach of physical protected health information (PHI) affecting 1,254 patients.

A journal maintained by an employee of Associate Dermatology was stolen from her vehicle on May 26, 2018. A thief forcibly gained access to the vehicle and stole the personal journal, which contained information to help the employee with the provision of care to patients.

The types of information recorded in the journal included names and ages of patients, their referring physicians, brief notes on patients’ medical histories, reasons for visits, and visit notes. Patients whose PHI has been obtained by the thief had received medical services through Associated Dermatology between September 1, 2017 and May 24, 2018.

While highly sensitive information – the types that can be used to steal identities – were not stored in the journal, there is potential the information could be misused, although no reports have been received to date to suggest that is the case.

The biggest risk is the use of the information in social engineering or phishing scams that attempt to get patients to disclose further information such as Social Security numbers, dates of birth, and health insurance information. Patients have been warned to be alert to such scams.

The breach has prompted Associated Dermatology to implement further safeguards to ensure all forms of PHI are safeguarded and future incidents of this nature are prevented.

The theft has been reported to law enforcement authorities who are working to locate the journal. The incident will be reported to appropriate authorities, including the Department of Health and Human Services’ Office for Civil Rights, in due course.

The post Associated Dermatology & Skin Cancer Clinic of Helena Discloses PHI Breach Impacting 1,254 Patients appeared first on HIPAA Journal.

An unencrypted laptop computer containing the protected health information (PHI) of 870 patients of Michigan Medicine has been stolen.

The PHI was saved on a personal laptop computer which had been left unattended in an employee’s vehicle. A thief broke into the car and stole the employee’s bag, which contacted the device. The theft occurred on June 3, 2018 and it was immediately reported to law enforcement. Michigan Medicine was informed of the theft the following day on June 4.

The laptop contained a range of protected health information of patients who had participated in research studies. The types of information exposed varied depending on the type of research the patients had participated in. Highly sensitive information such as Social Security numbers, health plan ID numbers, and financial information were not stored on the device and addresses and contact telephone numbers were not exposed. The information exposed was limited to names, medical record numbers, gender, race, diagnoses, and treatment information.

All of the research studies had been approved by the Institutional Review Board (IRB) at Michigan Medicine and consent to collect the data and use the information for research had been obtained from the patients. The IRB requires all research studies involving human subjects to comply with strict regulatory requirements, which includes implementing safeguards to ensure patient confidentiality is assured.

While Michigan Medicine complied with all regulations and had implemented appropriate security controls to prevent the exposure of patient data, the employee violated IRB approvals and Michigan Medicine policies by downloading the research data to his personal laptop computer.

Michigan Medicine has policies in place that require all patient data stored on portable electronic devices such as laptop computers to be encrypted to prevent exposure of the data in case of loss or theft of a device. However, since the data were downloaded to a personally owned device without the knowledge of Michigan Medicine, the data were not encrypted; although, the employee’s laptop was protected with a password.

Patients have been notified of the breach and have been advised to monitor their insurance statements for signs of fraudulent activity, although the risk of misuse of data is believed to be low as the device did not contain the types of information necessary for identity theft or insurance fraud.

HIPAA requires patients to be notified of breaches of PHI without unnecessary delay and no later than 60 days following the discovery of a breach. Michigan Medicine should be commended for issuing notifications promptly – within three weeks of the discovery of the breach.

Michigan Medicine has conducted further training of the workforce to reiterate its patient privacy policies and educational materials are being improved “to further enhance key messages about the prohibited use of personal, unencrypted devices for storage of research data.”

The post Michigan Medicine Informs Hundreds of Patients of PHI Exposure appeared first on HIPAA Journal.