Two HIPAA-covered entities have recently disclosed they have been victims of phishing attacks that have potentially resulted in the exposure of patients’ protected health information (PHI).

Further Phishing Attack Reported by Florida Agency for Persons with Disabilities

The Florida Agency for Persons with Disabilities (FAPD), which provides support services for people with disabilities such as autism, cerebral palsy, spina bifida, and Downs syndrome, has experienced another phishing attack

The phishing attack occurred on April 10, 2018 and was limited to a single email account; however, that account contained the PHI of 1,951 customers or guardians.

While no evidence was uncovered to suggest any PHI was viewed or copied by the attacker, PHI access could not be ruled out with 100% certainty. The compromised email account contained information such as names, birth dates, addresses, telephone numbers, health information, and Social Security numbers.

All patients have now been notified of the breach and have been offered credit monitoring services for a year without charge.

Three days after the attack, FAPD implemented a security upgrade to prevent unauthorized individuals from accessing its email system and further training on email security protocols was provided.

This is not the first phishing attack to be reported by the agency in 2018. In February, a more extensive phishing attack occurred that resulted in multiple email accounts being compromised. That phishing attack affected more than 55,000 customers, whose names, birth dates, and Social Security numbers were potentially compromised.

Following the February attack, FAPD said it had implemented multi-factor authentication to prevent unauthorized accessing of its email accounts and provided further training for employees on email security protocols.

Patients Notified of Black River Medical Center Phishing Attack

Poplar Bluff, MO-based Black River Medical Center is alerting some of its patients that their protected health information has potentially been accessed by an unauthorized individual.

On April 23, 2018, a response to a phishing email allowed a hacker to gain access to the email account of a single employee. The email account contained a limited amount of protected health information, but not financial information or Social Security numbers. The breach was limited to names, addresses, phone numbers, and in some cases, treatment information.

The investigation confirmed that the incident was limited to the email account and no other systems were affected. No evidence was uncovered to suggest any PHI was accessed, obtained, or misused by the attacker.

Patients were notified of the incident on June 13, 2018, and a notice was posted on the healthcare provider’s website. The breach has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal, so it is currently unclear exactly how many patients have been impacted.

The post Florida Agency for Persons with Disabilities and Black River Medical Center Report Phishing Incidents appeared first on HIPAA Journal.

Two HIPAA-covered entities are alerting patients that some of their protected health information (PHI) has been obtained by thieves in recent burglaries.

PHI Taken from Employee of Christus Spohn Hospitals

The protected health information of patients of two Christus Spohn Hospitals in Corpus Christi has been stolen in a burglary.

A Christus Spohn employee was burgled on April 16, 2018 and PHI was taken including information such as names, birth dates, dates of service, medical record numbers, account numbers, ages, and other medical data. No financial information, driver’s license numbers, or Social Security numbers were compromised.

Patients affected by the breach had previously received treatment at Christus Spohn Health System’s Memorial or Shoreline hospitals. While PHI was obtained, the information does not appear to have been misused. Christus Spohn has confirmed that approximately 1,800 patients have been affected by the incident.

Steps have already been taken to prevent further incidents of this nature from occurring, and the employee in question has received further training on measures that need to be taken to ensure protected health information is safeguarded.

PHI of Patients of a San Francisco Acupuncturist Stolen

San Francisco acupuncturist Denise M. Bowden is notifying patients that some of their PHI was stolen from her Pacific Heights office. The acupuncturist discovered the burglary on April 30, 2018, with the offices ransacked at some point over the weekend of 28/29 April.

The thief stole a computer from her office that contained information such as patients’ names, addresses, contact telephone numbers, dates of service, diagnosis codes, and health insurance information. No financial information or Social Security numbers were stored on the computer.

While the computer was password protected, patient data were not encrypted and could therefore potentially be viewed by unauthorized individuals. No reports have been received to suggest any of the information on the computer has been accessed and misused. Patients were notified of the breach by mail on June 11, 2018.

The post PHI Stolen in San Francisco and Corpus Christi Burglaries appeared first on HIPAA Journal.

A phishing attack on Draper, UT-based HealthEquity Inc., has resulted in the exposure of members’ protected health information. The data breach was limited to one email account, although an analysis of the messages in the account revealed a range of PHI was potentially obtained by the attacker.

Information possibly compromised in the attack was limited to names, email addresses, HealthEquity member ID numbers, employer ID numbers, employer names, health account type, deduction amounts, and for some Michigan-based employees, Social Security numbers.

The breach was identified on April 13, 2018 and was discovered to have occurred two days previously, giving the attacker 48 hours to access messages in the account. Access to the compromised account was immediately terminated to prevent any further unauthorized access.

A third-party computer forensics firm was engaged to conduct a full investigation into the attack. The investigation confirmed that the breach was limited to a single email account and access was gained due to human error – the employee responding to a phishing message. No other systems were compromised or affected by the phishing attack.

While PHI access was possible, no evidence was uncovered to suggest the emails in the account were opened or PHI was obtained by the attacker, although out of an abundance of caution, all affected individuals have been offered complimentary credit monitoring and identity theft protection services through ID Experts.

As a HIPAA covered entity, HealthEquity is required to send notifications about the breach and issue a media notice to a prominent media outlet within 60 days of discovery of a PHI breach. That notice was provided to ClickOnDetroit. The breach was limited to two companies, both of which have been notified about the security incident.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights’ breach portal, so it is currently unclear how many individuals have been impacted by the incident.

The post PHI Compromised in HealthEquity Phishing Attack appeared first on HIPAA Journal.

An employee of Phoenix-based Terros Health was fooled by a phishing scam and inadvertently handed over login credentials to the attacker. That individual accessed the employee’s email account and potentially viewed or obtained a range of protected health information detailed in individual emails in the account. The breach was limited to one email account and access to other systems was not gained.

Terros Health learned of the phishing attack on April 12, 2018 and notified the media on June 8. All patients impacted by the breach have now been notified by mail.

An investigation into the attack revealed the employee responded to the phishing email on or around November 16, 2017, which was when the email account was first accessed by the attacker.

While almost 1,600 patients potentially had some of their PHI compromised as a result of the attack, for the majority of patients (1,241) the exposed information was limited to names and dates of birth. The remaining patients also had their addresses, email addresses, diagnoses, medical record numbers, and other protected health information exposed. 142 patients’ Social Security numbers were also present in the compromised email account and could potentially have been viewed or obtained. The majority of patients affected by the breach had previously received medical services at its 23^rd/Dunlap Avenue clinic.

Patients whose Social Security number was exposed have been offered credit monitoring and identity theft protection services for 12 months without charge.

Prior to the attack, Terros Health had implemented safeguards to prevent the unauthorized accessing of PHI, although the phishing attack bypassed those controls. Further steps have now been taken to improve security, policies and procedures have been enhanced, and additional security awareness training is being provided to staff.

The company said this was the largest data breach it has experienced in the entire history of the company.

The post 1,600 Patients Potentially Impacted by Terros Health Phishing Attack appeared first on HIPAA Journal.

Rise Wisconsin is alerting more than 3,700 plan members that some of their protected health information was potentially accessed by unauthorized individuals during a recent ransomware attack.

The ransomware was installed on its network on or around April 8, 2018. The ransomware attack was detected rapidly, although not in time to prevent the encryption of data.

Rise Wisconsin (formerly Community Partnerships Inc., and Center for Families) called in third party computer forensics experts to assist with the breach investigation and recovery process. While the investigation did not uncover any evidence to suggest protected health information was accessed or stolen in the attack, it was not possible to rule out data access and data theft with a high degree of certainty.

Potentially, the types of data that could have been accessed by the attackers includes names, addresses, dates of birth, Social Security numbers and, for certain patients, a limited amount of health information.  No financial information was compromised.

Rise Wisconsin has not disclosed how much the attackers demanded for the security keys to unlock the encrypted data or whether that ransom demand was paid.

Rise Wisconsin takes the security of health information very seriously and had implemented a range of security controls to prevent the unauthorized accessing of PHI. In this case those controls proved insufficient; however, steps have now been taken to enhance security and prevent further incidents of this nature from occurring. Those steps include placing further restrictions on network access and increasing staff information security awareness training.

The incident has been reported to appropriate authorities and law enforcement is investigating the attack. The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 3,731 plan members have been impacted by the incident.

The post 3,700 Rise Wisconsin Plan Participants Potentially Impacted by Ransomware Attack appeared first on HIPAA Journal.

A round up of healthcare data security incidents reported in the past few days that have resulted in the protected health information of patients being obtained by unauthorized individuals.

Blue Cross Blue Shield of Illinois Discovers PHI was Provided to an Imposter

Blue Cross Blue Shield of Illinois has discovered the protected health information of some plan members has been disclosed to a doctor who was impersonating another physician. The doctor was employed by its business associate Dane Street and conducted peer to peer reviews for the firm – Further reviews when requests for services have been denied by an insurance company.

Dane Street was notified by law enforcement on April 9, 2018 that the doctor had been fraudulently impersonating another physician in order to perform peer to peer reviews. Those reviews required the doctor to view information such as names, addresses, dates of birth, phone numbers, medical service information, and Social Security numbers.

Since Social Security numbers were disclosed, affected patients have been offered complimentary credit monitoring services for one year. Dane Street no longer employs the doctor the matter is in the hands of law enforcement.

Dane Street has implemented additional credentialing procedures to prevent incidents of this nature from occurring in the future.

Around 3,000 Patients of Quality Care Pharmacy Notified of PHI Exposure

Approximately 3,000 patients of Quality Care Pharmacy in San Marcos, CA have been notified that some of their protected health information has been obtained by thieves.

Professional thieves targeted the pharmacy, located in a San Marcos strip mall, and stole hundreds of thousands of dollars of medications and a computer containing unencrypted protected health information. According to a 10News report, the thieves also drilled the safe and stole its contents and managed to circumvent all security measures put in place by the pharmacy.

Security protections had been improved following two previous burglaries at the pharmacy, although they proved insufficient to prevent the break-in.

Patients impacted by the breach have now been notified by mail, although it allegedly took nine weeks for some patients to receive their notification letters.

Hacker Gain Access to Elmcroft Senior Living Inc., Servers

A hacker has gained access to servers used by Elmcroft Senior Living Inc., and potentially viewed and copied the protected health information of patients and current and former residents. The breach occurred on May 10, 2018 and was detected two days later on May 12.

The types of information potentially accessed includes residents’ names, names of family members, birth dates, addresses, demographic information, and Social Security numbers. The PHI of former residents and patients of its healthcare facilities were also potentially accessed. All individuals affected by the breach have been notified and offered credit and identity theft monitoring services.

Care Partners Hospice and Palliative Care Reports Email Breach

The PHI of 600 patients of Care Partners Hospice and Palliative Care has potentially been accessed by an unauthorized individual who gained access to the email account of one of its employees.  The breach was detected on April 11, 2018 prompting a full investigation. A third-party cybersecurity expert was called in to assist with the investigation and determine how access to the email account was gained and which patients were potentially affected.

Data theft was not confirmed, although could not be ruled out with a high degree of certainty. The breach was limited to the email account and no other systems were compromised. No reports have been received to suggest any information in the email account has been misused.

The incident has prompted Care Partners Hospice and Palliative Care to augment its email security protections and improve system and network security.

The post Impostor, Burglar, and Hackers Obtain PHI of Patients appeared first on HIPAA Journal.