Arlington-based Texas Health Resources, a provider group serving more than 1.7 million patients in North Texas, is notifying ‘fewer than 4,000 patients’ that some of their sensitive information may have been accessed by an unauthorized individual. The data breach occurred as early as October 2017, although it was not discovered until January 17, 2018, when the health system was notified of a breach by law enforcement. The potentially compromised data was saved in email accounts that the attacker had access to for up to three months.

The delay in issuing breach notification letters, which would normally have to be issued within 60 days of the discovery of the breach under HIPAA Rules, was at the request of law enforcement. HIPAA covered entities are permitted to delay the issuing of notifications if law enforcement believes such an act would impede an investigation. Law enforcement has only recently given the OK to start sending notifications. It is unclear whether the law enforcement investigation resulted in the apprehension of a suspect.

Texas Health Resources explained in its substitute breach notice that the incident was part of a larger attack that affected multiple entities across the United States. It is currently unclear which other healthcare organizations were also targeted by the attacker and therefore the true scale of the campaign.

Texas Health Resources conducted its own internal investigation into the breach and determined that the compromised email accounts contained information such as names, dates of birth, Social Security numbers, medical record numbers, drivers’ license numbers, state ID numbers, insurance information, and clinical information. Most of the affected individuals had received medical services at Texas Health Resources facilities in 2017.

Individuals whose Social Security numbers were exposed have been offered complimentary identity theft and credit monitoring services for one year without charge. No reports have been received to suggest any of the information has been misused.

Texas Health continuously works on improving its safeguards to keep protected health information confidential and secure and will be enhancing security monitoring to ensure any future security incidents are detected rapidly in the future.

The post Texas Health Resources Notifies 4,000 Patients of Email Account Breach appeared first on HIPAA Journal.

Inogen, a manufacturer of portable oxygen concentrators, has discovered an unauthorized individual has obtained the credentials of an employee and has used them to gain access to the employee’s email account.

Phishing and other credentials theft incidents are common in the healthcare sector, although what makes this incident stand out is the number of individuals impacted by the attack. The compromised email account contained the personal information of approximately 30,000 individuals who had previously been provided with oxygen supply devices.

The types of information potentially viewed and obtained by the attacker include name, telephone number, address, email address, date of birth, date of death, types of equipment provided, Medicare ID number and health insurance information. Medical records, Social Security numbers, and payment card information were not compromised.

Also notable is the length of time it took to discover the breach. Inogen reports that access to the email account was first gained on January 2, 2018 and continued until March 14. Forensic investigators were hired to determine exactly how the breach occurred, its extent, and the number of patients impacted. The forensics firm confirmed the account was accessed and based on the IP address used to access the account, the perpetrator was located in a foreign country.

While stolen credentials were used in the attack, it is currently unclear exactly how those credentials were obtained. While phishing is a possibility, the credentials could also have been obtained by other means, such as a man-in-the-middle attack.

Since there is potential for insurance information to be misused by the attacker, Inogen has offered credit monitoring services to affected individuals and they will be protected by an insurance reimbursement policy. While that policy will cover losses in the event of insurance information misuse, Inogen has said that the policy may not cover all expenses related to the misuse of information.

Inogen is required to comply with Health Insurance Portability and Accountability Act Rules and has reported to the security breach to the Department of Health and Human Services’ Office for Civil Rights. Affected individuals have been notified by mail and relevant state attorneys general have been sent a data breach summary.

Security has been strengthened following the attack, which includes the use of two-factor authentication. If an unfamiliar device is used to access an account, a second form of authentication will be required before access to the account is granted. Additionally, all passwords have been reset, further electronic tools deployed to prevent unauthorized access, and employee training has been enhanced.

The post Oxygen Equipment Manufacturer Discovers Credential Theft Incident Potentially Impacts 30,000 appeared first on HIPAA Journal.

The Chicago, IL-based physiatry group Integrated Rehab Consultants is sending notification letters to certain patients alerting them to the exposure of some of their protected health information, as is required by HIPAA. However, the breach was not discovered in the past 60 days. Integrated Rehab Consultants (IRC) first became aware of the exposure of PHI on December 2, 2016 – 16 months ago.

The data – which included patients’ full names, address, date of birth, gender, medical provider information, visit date, visit status, admission date, appointment visit ID, treatment location, procedure code, and diagnosis codes – had been uploaded to a publicly accessible repository. The PHI was discovered by a healthcare security researcher who notified IRC about the breach.

Prompt action was taken to remove and secure the data and an investigation was launched to determine how and why the data had been uploaded to an insecure location. That investigation determined that a business associate who had been provided with the PHI had disclosed the information to a third party. It was that subcontractor that made the error and uploaded the data to the public repository.

At the time, IRC only believed the data had been accessed by the security researcher. However, in its substitute breach notice, IRC explained that in the fall of 2017 it became apparent that other individuals may also have gained access to the data.

Patients potentially impacted have been offered complimentary credit monitoring and identity restoration services for 12 months without charge and notified about the incident ‘out of an abundance of caution.’ ICR has not received any reports to suggest any patient information has been misused, although affected individuals have been urged to check their credit reports and EoB statements carefully and to remain vigilant against incidents of identity theft and fraud.

It is unclear why patients were not notified of the exposure of their PHI within 60 days of the initial discovery that their PHI had been exposed, nether why there was a further delay in issuing notifications when it was suspected that other individuals may have gained access to the data.

The post Integrated Rehab Consultants Takes 16 Months to Notify Patients of PHI Breach appeared first on HIPAA Journal.

A former employee of Baptist Health’s West Kendall Baptist Hospital in Miami, FL has been discovered to have stolen the credit card details of at least one patient and used the information to make fraudulent purchases.

The misuse of credit cards was discovered by Baptist Health on March 9, 2018 and the matter was referred to Miami-Dade law enforcement and the employee was terminated.

Baptist Health has not specified exactly how many patients have been confirmed to have been defrauded by the employee, although 1,480 patients have been sent breach notification letters to alert them to the possibility that their credit card details may have been misused.

Any patient who paid for medical services using a credit card with the registration employee between August 2014 and March 2018 have potentially had their name, date of birth, and credit card details stolen and misused.

As a precaution, all 1,480 patients have been offered identity theft protection and credit monitoring services for 12 months without charge and have been advised to check their credit card statements carefully for any unauthorized purchases.

Baptist Health is exploring options to further protect patient health information and prevent any further breaches of this nature from occurring in the future.

The post Baptist Health Alerts Almost 1,500 Patients to Possible Abuse of Credit Card Details appeared first on HIPAA Journal.

A misconfigured security setting on a radiology interface has resulted in the exposure of tens of thousands of patients’ protected health information.

Middletown Medical, a multi-specialty physicians’ group based in Middleton, NY, discovered the misconfigured security setting on January 29, 2018.

The following day the interface was secured to ensure unauthorized individuals were prevented from accessing patient information. It is unclear for how long patient data was accessible. Middletown Medical says only a limited number of patients’ PHI could have been accessed by unauthorized individuals.

Highly sensitive information such as financial data, Social Security numbers, and insurance information were not exposed. The breach was limited to names, client identification numbers, birth dates, confirmation that radiology services had been received by patients, and the dates those services were provided. A limited number of patients also had diagnosis codes, radiology images, and radiology reports exposed.

The discovery of the error prompted Middletown Medical to review its polices and procedures and implement additional safeguards to ensure the confidentiality of documents containing PHI. Additional training has been provided to staff on securing information systems and modifications have been made to interfaces to ensure all information remains secure.

No reports of misuse of PHI have been received although, out of an abundance of caution, all patients impacted by the breach have been offered complimentary identity theft recovery services for 12 months and have been advised to carefully review their account statements and Explanation of Benefits statements for any sign or fraudulent activity.

The data breach summary submitted to the Department of Health and Human Services’ Office for Civil Rights indicates up to 63,551 patients had their PHI exposed, making this one of the largest healthcare security incidents to be reported so far this year.

The post 63,500 Patients Impacted by Middletown Medical Data Breach appeared first on HIPAA Journal.

Body:

Chesapeake Regional Healthcare has discovered two hard drives containing the protected health information (PHI) of approximately 2,100 patients are missing from the Chesapeake Regional Medical Center campus in Chesapeake, Virginia.

The data stored on the devices relates to individuals who took part in studies at its Sleep Center between April 2015 and February 2018.

It is currently unclear exactly when the hard drives went missing. Chesapeake Regional Healthcare discovered the devices were missing on February 6, 2018. An internal investigation was launched, and a full search of the facility was conducted, but the devices could not be located. The missing hard drives have been reported as lost/stolen to law enforcement, but Chesapeake Regional Healthcare said the probability of the devices being recovered is low and it does not expect the devices to be found.

The hard drives were not encrypted. If obtained by a third party, the protected health information of patients could potentially be accessed. The types of information stored on the devices includes names, demographic information, birth dates, unique patient identifiers, details of the procedures and tests performed at the Sleep Center, and information on medications that were prescribed. Social Security numbers, addresses, insurance information, and financial data were not stored on the device.

Chesapeake Regional Healthcare is taking steps to ensure similar breaches do not occur in the future. Those steps include improving policies related to the security of PHI stored on portable electronic devices. It is not clear whether the new measures will include data encryption.

Chesapeake Regional Healthcare is currently in the process of sending notifications to patients, who are being offered 12 months of complimentary credit monitoring and identity theft protection services. In the event that patients discover their health information has been used inappropriately, assistance will be offered to help mitigate any harm caused.

The post Chesapeake Regional Healthcare Reports PHI of 2,100 Patients Was Stored on Lost Hard Drives appeared first on HIPAA Journal.