An unencrypted laptop computer containing the protected health information (PHI) of 870 patients of Michigan Medicine has been stolen.

The PHI was saved on a personal laptop computer which had been left unattended in an employee’s vehicle. A thief broke into the car and stole the employee’s bag, which contacted the device. The theft occurred on June 3, 2018 and it was immediately reported to law enforcement. Michigan Medicine was informed of the theft the following day on June 4.

The laptop contained a range of protected health information of patients who had participated in research studies. The types of information exposed varied depending on the type of research the patients had participated in. Highly sensitive information such as Social Security numbers, health plan ID numbers, and financial information were not stored on the device and addresses and contact telephone numbers were not exposed. The information exposed was limited to names, medical record numbers, gender, race, diagnoses, and treatment information.

All of the research studies had been approved by the Institutional Review Board (IRB) at Michigan Medicine and consent to collect the data and use the information for research had been obtained from the patients. The IRB requires all research studies involving human subjects to comply with strict regulatory requirements, which includes implementing safeguards to ensure patient confidentiality is assured.

While Michigan Medicine complied with all regulations and had implemented appropriate security controls to prevent the exposure of patient data, the employee violated IRB approvals and Michigan Medicine policies by downloading the research data to his personal laptop computer.

Michigan Medicine has policies in place that require all patient data stored on portable electronic devices such as laptop computers to be encrypted to prevent exposure of the data in case of loss or theft of a device. However, since the data were downloaded to a personally owned device without the knowledge of Michigan Medicine, the data were not encrypted; although, the employee’s laptop was protected with a password.

Patients have been notified of the breach and have been advised to monitor their insurance statements for signs of fraudulent activity, although the risk of misuse of data is believed to be low as the device did not contain the types of information necessary for identity theft or insurance fraud.

HIPAA requires patients to be notified of breaches of PHI without unnecessary delay and no later than 60 days following the discovery of a breach. Michigan Medicine should be commended for issuing notifications promptly – within three weeks of the discovery of the breach.

Michigan Medicine has conducted further training of the workforce to reiterate its patient privacy policies and educational materials are being improved “to further enhance key messages about the prohibited use of personal, unencrypted devices for storage of research data.”

The post Michigan Medicine Informs Hundreds of Patients of PHI Exposure appeared first on HIPAA Journal.

Two HIPAA-covered entities have recently disclosed they have been victims of phishing attacks that have potentially resulted in the exposure of patients’ protected health information (PHI).

Further Phishing Attack Reported by Florida Agency for Persons with Disabilities

The Florida Agency for Persons with Disabilities (FAPD), which provides support services for people with disabilities such as autism, cerebral palsy, spina bifida, and Downs syndrome, has experienced another phishing attack

The phishing attack occurred on April 10, 2018 and was limited to a single email account; however, that account contained the PHI of 1,951 customers or guardians.

While no evidence was uncovered to suggest any PHI was viewed or copied by the attacker, PHI access could not be ruled out with 100% certainty. The compromised email account contained information such as names, birth dates, addresses, telephone numbers, health information, and Social Security numbers.

All patients have now been notified of the breach and have been offered credit monitoring services for a year without charge.

Three days after the attack, FAPD implemented a security upgrade to prevent unauthorized individuals from accessing its email system and further training on email security protocols was provided.

This is not the first phishing attack to be reported by the agency in 2018. In February, a more extensive phishing attack occurred that resulted in multiple email accounts being compromised. That phishing attack affected more than 55,000 customers, whose names, birth dates, and Social Security numbers were potentially compromised.

Following the February attack, FAPD said it had implemented multi-factor authentication to prevent unauthorized accessing of its email accounts and provided further training for employees on email security protocols.

Patients Notified of Black River Medical Center Phishing Attack

Poplar Bluff, MO-based Black River Medical Center is alerting some of its patients that their protected health information has potentially been accessed by an unauthorized individual.

On April 23, 2018, a response to a phishing email allowed a hacker to gain access to the email account of a single employee. The email account contained a limited amount of protected health information, but not financial information or Social Security numbers. The breach was limited to names, addresses, phone numbers, and in some cases, treatment information.

The investigation confirmed that the incident was limited to the email account and no other systems were affected. No evidence was uncovered to suggest any PHI was accessed, obtained, or misused by the attacker.

Patients were notified of the incident on June 13, 2018, and a notice was posted on the healthcare provider’s website. The breach has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal, so it is currently unclear exactly how many patients have been impacted.

The post Florida Agency for Persons with Disabilities and Black River Medical Center Report Phishing Incidents appeared first on HIPAA Journal.

Two HIPAA-covered entities are alerting patients that some of their protected health information (PHI) has been obtained by thieves in recent burglaries.

PHI Taken from Employee of Christus Spohn Hospitals

The protected health information of patients of two Christus Spohn Hospitals in Corpus Christi has been stolen in a burglary.

A Christus Spohn employee was burgled on April 16, 2018 and PHI was taken including information such as names, birth dates, dates of service, medical record numbers, account numbers, ages, and other medical data. No financial information, driver’s license numbers, or Social Security numbers were compromised.

Patients affected by the breach had previously received treatment at Christus Spohn Health System’s Memorial or Shoreline hospitals. While PHI was obtained, the information does not appear to have been misused. Christus Spohn has confirmed that approximately 1,800 patients have been affected by the incident.

Steps have already been taken to prevent further incidents of this nature from occurring, and the employee in question has received further training on measures that need to be taken to ensure protected health information is safeguarded.

PHI of Patients of a San Francisco Acupuncturist Stolen

San Francisco acupuncturist Denise M. Bowden is notifying patients that some of their PHI was stolen from her Pacific Heights office. The acupuncturist discovered the burglary on April 30, 2018, with the offices ransacked at some point over the weekend of 28/29 April.

The thief stole a computer from her office that contained information such as patients’ names, addresses, contact telephone numbers, dates of service, diagnosis codes, and health insurance information. No financial information or Social Security numbers were stored on the computer.

While the computer was password protected, patient data were not encrypted and could therefore potentially be viewed by unauthorized individuals. No reports have been received to suggest any of the information on the computer has been accessed and misused. Patients were notified of the breach by mail on June 11, 2018.

The post PHI Stolen in San Francisco and Corpus Christi Burglaries appeared first on HIPAA Journal.

A phishing attack on Draper, UT-based HealthEquity Inc., has resulted in the exposure of members’ protected health information. The data breach was limited to one email account, although an analysis of the messages in the account revealed a range of PHI was potentially obtained by the attacker.

Information possibly compromised in the attack was limited to names, email addresses, HealthEquity member ID numbers, employer ID numbers, employer names, health account type, deduction amounts, and for some Michigan-based employees, Social Security numbers.

The breach was identified on April 13, 2018 and was discovered to have occurred two days previously, giving the attacker 48 hours to access messages in the account. Access to the compromised account was immediately terminated to prevent any further unauthorized access.

A third-party computer forensics firm was engaged to conduct a full investigation into the attack. The investigation confirmed that the breach was limited to a single email account and access was gained due to human error – the employee responding to a phishing message. No other systems were compromised or affected by the phishing attack.

While PHI access was possible, no evidence was uncovered to suggest the emails in the account were opened or PHI was obtained by the attacker, although out of an abundance of caution, all affected individuals have been offered complimentary credit monitoring and identity theft protection services through ID Experts.

As a HIPAA covered entity, HealthEquity is required to send notifications about the breach and issue a media notice to a prominent media outlet within 60 days of discovery of a PHI breach. That notice was provided to ClickOnDetroit. The breach was limited to two companies, both of which have been notified about the security incident.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights’ breach portal, so it is currently unclear how many individuals have been impacted by the incident.

The post PHI Compromised in HealthEquity Phishing Attack appeared first on HIPAA Journal.