MedEvolve, a provider of electronic billing and record services to healthcare providers, has announced that an FTP server used by the firm had been left unsecured between March 29, 2018 and May 4, 2018.

The FTP server contained a file that included the protected health information of patients. On March 29, the day that the protection was removed, the file was accessed by an unauthorized individual. MedEvolve discovered the breach on May 11, 2018.

According to the breach notice submitted to the California Attorney General, the file contained the data of patients of Premier Immediate Medical Care.

MedEvolve did not mention in the breach notice how many patients had been affected and the incident has yet to appear of the Department of Health and Human Services’ Breach Portal. However, in May, databreaches.net was alerted to the exposure of data by a security researcher who discovered the unprotected FTP server. According to the report, the file contained approximately 205,000 lines of patient data, each corresponding to a different patient. More than 11,000 Social Security number were included in the data.

Patient information from a second client, Beverly, L. Held, M.D, a corpus Christi dermatologist, was also present on the server in three separate .dat files according to the databreaches.net report. Those files allegedly included an estimated 12,000 Social Security numbers. No mention of this client was made in the MedEvolve breach notice.

MedEvolve explained in its breach notice that names, billing addresses, telephone numbers, health insurer names, health insurance numbers, and Social Security numbers were present in the file. No financial data, treatment information or health data were exposed.

MedEvolve said that upon discovery of the breach, the FTP server was secured to prevent any further unauthorized access and a third-party forensic investigator was hired to conduct a full investigation. The investigation into the breach is ongoing and further security controls are being implemented to enhance the privacy and security of its information systems.

Due to the sensitive nature of the data that were exposed, MedEvolve is offering affected patients 24 months of complimentary credit monitoring services through myTrueIdentity, which includes up to $1,000,000 of identity theft insurance.

The post MedEvolve Notifies Patients of PHI Exposure Through Unsecured FTP Server appeared first on HIPAA Journal.

A former employee of Arkansas Children’s Hospital is being investigated by law enforcement over the theft and misuse of patients’ protected health information. According to the breach notice submitted to the Department of Health and Human Services’ Office for Civil Rights, the former employee potentially viewed and copied the PHI of up to 4,521 patients.

That individual was employed at Arkansas Children’s Hospital for 15 months between November 7, 2016 and February 6, 2018. During that time the employee was provided with access to patient health information to perform essential functions of the job.

On May 9, 2018, law enforcement notified Arkansas Children’s Hospital that an investigation had been launched over the possible theft of patients’ Social Security numbers and personal information and the misuse of that information for personal gain.

Arkansas Children’s Hospital immediately launched an investigation to determine the types of information that were potentially accessed and whether patients’ PHI had been accessed without authorization. While that internal investigation confirmed the types of information that were potentially accessed, it was not possible to determine whether the information was accessed for work purposes or other reasons.

Consequently, the incident has been treated as a data breach and all patients have now been notified of the possible theft and misuse of their PHI. The types of information potentially stolen includes full names, dates of birth, addresses, contact telephone numbers, Social Security numbers, health insurance information, charge amounts, descriptions of services received, and some clinical information.

As a precaution against identity theft and fraud, all 4,521 patients have been offered complimentary credit monitoring and identity theft protection services for 12 months. Patients have been advised to monitor their credit reports, financial statements, and Explanation of Benefits statements for any sign of fraudulent activity.

The employee has been terminated and Arkansas Children’s Hospital has now implemented additional hiring controls and has retrained its employees on internal policies and procedures and HIPAA Rules covering the accessing of patient information.

The post Former Arkansas Children’s Hospital Employee Investigated Over Potential Theft of 4,500 Patients’ PHI appeared first on HIPAA Journal.

Manitowoc County in Wisconsin has announced protected health information has been stolen as a result of a successful phishing attack. The incident occurred on or around January 14, 2018, although the attack and data breach was not discovered until April 24. While the account was immediately secured to prevent any further access, the attacker had well over two months to view and obtain sensitive data stored in the email account.

During the time that the attacker had email account access, emails sent to that account were diverted to a different email account to which Manitowoc County staff had no access. While County officials have not uncovered any evidence to suggest any of the information in the emails has been misused, they have similarly not been able to establish that sensitive data have not been misused or sold on.

The types of information that were stolen include names, telephone numbers, email addresses, addresses, and dates of birth. Individuals who received services through the County have also had their health information, insurance information, details of prescriptions, client ID numbers, diagnoses, and other treatment related information stolen by the attacker.

Manitowoc County has not publicly disclosed how many individuals have been impacted and the incident has yet to be listed on the Department of Health and Human Services’ Office for Civil Right breach portal. However, Manitowoc County has now issued notifications to all individuals impacted by the phishing attack.

Breach victims have been warned that they should be alert to phishing emails that claim to be from Manitowoc County. County officials have confirmed that they will not send any emails or make calls to people impacted by this incident and request further personal information. Individuals impacted by the breach have also been told to be wary of any emails containing hyperlinks, to exercise caution opening any emails, and not to disclose sensitive information to individuals over the telephone.

The phishing attack has prompted the County to take further steps to enhance security controls and additional investments will be made in new protocols, technology and training to prevent further successful phishing attacks from occurring.

The post PHI Stolen As a Result of Manitowoc County Phishing Attack appeared first on HIPAA Journal.

Humana is notifying members in several states that their PHI has potentially been accessed during a ‘sophisticated’ spoofing attack.

A spoofing attack is an attempt by a threat actor or bot to gain access to a system or data using stolen or spoofed login credentials. Humana became aware of the attack on June 3, when large numbers of failed login attempts were detected from foreign IP addresses. Prompt action was taken to block the attack, with the foreign IP addresses blocked from accessing its Humana.com and Go365.com websites on June 4.

Humana suggests “the nature of the attack and observed behaviors indicated the attacker had a large database of user identifiers (IDs).” It is possible the login credentials are old and that they were obtained in a separate third-party breach, although Humana notes that “the excessive number of log in failures strongly suggests the ID and password combinations did not originate from Humana.”

The website accounts did not contain Social Security numbers or financial information; however, the following types of information could potentially have been accessed by the attackers: Details of medical, dental, and vision claims, provider name, dates of service, services performed, charge amounts, paid amounts, spending account information, balance information, wellness information, and biometric screening data.

Humana says it has not uncovered any evidence to suggest any members’ data were stolen in the attack; however, as a precaution, all members whose accounts could potentially have been accessed have been offered 12 months of credit monitoring and identity theft protection services through the Equifax Credit Watch Gold service. A password reset has been performed on all accounts.

Humana is currently deploying new controls to improve the security of its websites and has implemented a new system for alerts of successful and failed login attempts.

This attack could simply be a brute force attempt to gain access to users’ accounts with just a username obtained in a previous breach and a list of possible passwords. To reduce the potential for such an attack resulting in unauthorized account access, strong, complex passwords should be used for accounts that have not previously been used on any other account.

If possible, two-factor authentication should also be activated. This requires an additional piece of information – a code sent to a mobile phone for instance – to be entered when an unfamiliar device or IP attempts to gain access to an account.

The post Sophisticated Cyber Spoofing Attack Reported by Humana appeared first on HIPAA Journal.

The Alaska Department of Health and Social Services (ADHSS) is notifying ‘more than 500’ individuals that some of their protected health information (PHI) has potentially been accessed and stolen by hackers.

On April 26, the ADHSS discovered malware had been installed on an employee’s computer after suspicious behavior was detected. The investigation revealed malware had been installed – a variant of the Zeus/Zbot Trojan – which is known to be used to steal sensitive information.

The malware was discovered to have communicated with IP addresses in Russia, although it is not known whether the attackers are based in Russia or just using Russian IP addresses. ADHSS has not confirmed whether protected health information was exfiltrated to those IP addresses, although data access and theft of PHI is a possibility.

Under the Health Insurance Portability and Accountability Act, HIPAA-covered entities must report data breaches as soon as possible, but no later than 60 days following the discovery of a breach. AHDSS chose to delay the issuing of notifications until just before the deadline to allow investigators to determine the nature and extent of the breach.

The infected computer contained a range of documents that included sensitive information of individuals in the Northern region of Alaska. Patients affected by the breach had previously had dealings with the ADHSS division of Public Assistance (DPA) through the DPA Northern regional offices.

The types of information potentially stolen include first and last names, phone numbers, dates of birth, pregnancy status, death status, incarceration status, Medicaid/Medicare billing codes, Social Security numbers, driver’s license numbers, and other confidential information.

In its breach notice, ADHSS explained it had multiple layers of security in place to prevent malware infections, but in this instance those defenses had been bypassed.

Immediately after the virus was discovered the computer was taken offline to prevent any further data access. The ADHSS Information Technology and Security team is continuing to investigate the breach and will be implementing additional protections to prevent further breaches of this nature.

The post Zeus Trojan Infection Potentially Resulted in Theft of PHI from Alaska DHSS appeared first on HIPAA Journal.

This week, Associated Dermatology & Skin Cancer Clinic of Helena, MT, has disclosed a breach of physical protected health information (PHI) affecting 1,254 patients.

A journal maintained by an employee of Associate Dermatology was stolen from her vehicle on May 26, 2018. A thief forcibly gained access to the vehicle and stole the personal journal, which contained information to help the employee with the provision of care to patients.

The types of information recorded in the journal included names and ages of patients, their referring physicians, brief notes on patients’ medical histories, reasons for visits, and visit notes. Patients whose PHI has been obtained by the thief had received medical services through Associated Dermatology between September 1, 2017 and May 24, 2018.

While highly sensitive information – the types that can be used to steal identities – were not stored in the journal, there is potential the information could be misused, although no reports have been received to date to suggest that is the case.

The biggest risk is the use of the information in social engineering or phishing scams that attempt to get patients to disclose further information such as Social Security numbers, dates of birth, and health insurance information. Patients have been warned to be alert to such scams.

The breach has prompted Associated Dermatology to implement further safeguards to ensure all forms of PHI are safeguarded and future incidents of this nature are prevented.

The theft has been reported to law enforcement authorities who are working to locate the journal. The incident will be reported to appropriate authorities, including the Department of Health and Human Services’ Office for Civil Rights, in due course.

The post Associated Dermatology & Skin Cancer Clinic of Helena Discloses PHI Breach Impacting 1,254 Patients appeared first on HIPAA Journal.