Last week, a ransomware attack against the EHR vendor Allscripts resulted in thousands of healthcare providers being unable to access patient data or use the e-prescription service. Already, a class action lawsuit against Allscripts has been filed by Florida-based Surfside Non-Surgical Orthopedics.

Allscripts provides EHR and e-prescription services to 2,500 hospitals and 19,000 post-acute care organizations. Last week, a new variant of SamSam ransomware infected the company´s data centers in Raleigh and Charlotte, NC, leaving several application offline for up to 1,500 clients.

Microsoft and Cisco incident response teams helped the company restore its e-prescribing service by Saturday; but, for many clients, the Allscripts PRO EHR system is still unavailable or experiencing outages. An Allscripts spokesperson has been unable to confirm when a full restore will be completed.

The Class Action Lawsuit against AllScripts

The class action lawsuit against Allscripts was filed in the United States District Court for the Northern District of Illinois where the company is based. It alleges Allscripts was negligent in failing to secure its systems against cyberattacks and that the company was aware of vulnerabilities in its online security. The complaint quotes the company´s most recent 10-K filing which notes: “If our security is breached, we could be subject to liability, and our clients could be deterred from using our products and services”.

According to lawyers representing the plaintiff – Florida-based Surfside Non-Surgical Orthopedics – Allscripts forecast the ransomware attack in the K-10 filing; and, as a result of the attack, their client suffered “significant business interruption and disruption, and lost revenues”. The class action lawsuit against Allscripts also alleges breach of contract, unjust enrichment, and violations of Illinois´ Uniform Deception Trade Practices Act and Consumer Fraud Act.

Steven Tapper – a member of the team that filed the class action lawsuit against Allscripts – believes the ransomware attack could have affected many more clients than the company is admitting. He told reporters: “We really don’t know. Allscripts hasn’t disclosed the full extent of the impact”. His colleague – John Yanchunis – added it could take as long as eighteen months to resolve the case, but Allscripts may choose to seek an immediate resolution. “I would hope that would be the case here,” he said.

Allscripts Could Also Face Penalties for Violating HIPAA

According to the Department of Health and Human Services´ “Fact Sheet: Ransomware and HIPAA” (PDF), when ePHI is encrypted by ransomware, unauthorized individuals are presumed to have taken control of the ePHI. This is an unauthorized disclosure of PHI under the HIPAA Privacy Rule and will have to be reported to HHS, unless it can be demonstrated there is a low probability that the PHI has been compromised. It is not known whether Allscripts maintained ePHI in an encrypted format.

Even if the company escapes a penalty for the unauthorized disclosure of ePHI, the HHS may well launch an investigation following the revelations made in the class action lawsuit against Allscripts. The likely aspects of HIPAA compliance that would go under HHS scrutiny include employee security training (for example, how did the ransomware attack breach network defenses), ransomware recognition, security incident reporting and – considering the delay in fully restoring its systems – disaster recovery plans.

The post Class Action Lawsuit against Allscripts Filed following Ransomware Attack appeared first on HIPAA Journal.

A malware infection at Westminster Ingleside King Farm Presbyterian Retirement Communities has potentially enabled the attackers to gain access to the protected health information of thousands of its residents.

The Washington D.C., based assisted living facility had implemented a wide range of security solutions to prevent unauthorized access to its systems, although in this instance they were unable to block the attack.

The malware was discovered on November 21, 2017, with rapid action taken to identify all instances of the malware on its network and remove the malicious code to prevent further access. While the malware was successfully removed, assistance was sought from third party experts to determine how the attackers had managed to bypass its security defenses, and whether access to the protected health information of its residents had been gained.

The investigation into the breach highlighted a number of areas where security could be improved to further protect its systems from attack. Ingleside has now implemented a new firewall, upgraded its antimalware and antivirus software, and has adopted two-factor authentication on user accounts. New user credentials have been issued and strong passwords set. Staff have also received additional training to help them identify unauthorized access.

While no evidence was uncovered to suggest the protected health information of its residents was accessed, it was not possible to rule out data access and data theft with 100% certainty. Consequently, all affected individuals have been notified about the potential breach and, out of an abundance of caution, residents have been offered credit monitoring and identity theft protection services via Kroll for 12 months without charge.

No financial information was compromised as a result of the malware infection, although names, addresses, Social Security numbers, and other protected health information were potentially compromised.

The breach notice submitted to the Department of Health and Human Services’ Office for Civil Rights indicates up to 5,228 residents were impacted by the security breach.

The post Malware Causes 5,200-Record Data Breach at DC Assisted Living Facility appeared first on HIPAA Journal.

Pedes Orange County Inc., a California healthcare provider specializing in treatments for vascular disease, is alerting some of its patients that a physician accessed their medical records, without authorization, and provided some of that information to an attorney.

Pedes shares its facilities with another medical group, which conducts surgical procedures at the facility during the week. A scheduling tool is also shared with other physicians that use the same facility.

On November 14, 2017, Pedes became aware that a physician employed by a different medical group had accessed its electronic medical records database and viewed the records of some of its patients. Pedes did not provide authorization for the EMR to be accessed.

Pedes reports that the physician subsequently shared some of the information in the database with an attorney. After discovering the breach, the physician was contacted and Pedes has been working to ensure all copies of patients’ PHI that were obtained from its EMR system are securely destroyed and that no copies remain.

The types of information potentially compromised includes names, diagnoses, treatments, dates of service, and other treatment related data. No financial information or Social Security numbers were stored in the database and remained secure at all times.

While information was taken from the database, Pedes has no reason to believe any PHI has been misused. However, since the incident is classed as a security breach under HIPAA Rules, notifications about the breach must be sent to patients.

Although data misuse is not suspected, patients have been advised to take precautions and examine their Explanation of Benefits statements and other information from their health insurers for any medical treatments listed by not provided.

The incident has prompted Pedes to conduct a review of its security protocols, which will be updated to ensure that this type of security breach does not happen again.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates the PHI of up to 917 patients was accessed and potentially disclosed.

The post Pedes Orange County Discovers Physician Accessed and Disclosed PHI Without Authorization appeared first on HIPAA Journal.

53,173 patients who received services from Onco360 and CareMed Specialty Pharmacy have been notified that some of their protected health information has been compromised.

A security breach was suspected on November 14, 2017, when suspicious activity involving an employee’s email account was detected.

Third party computer forensics experts were called in to conduct an investigation to determine the nature and scope of the breach. On November 30, it was determined that the breach involved three email accounts.

An analysis of the emails in those accounts revealed some messages contained the PHI of patients, which could potentially have been accessed and stolen by the hacker.

The information potentially compromised included names, demographic information, clinical information, details of medications provided by the pharmacy, Social Security numbers, and health insurance information. A limited number of patients may also have had some financial information exposed.

No reports have been received to suggest any protected health information has been misused, although patients have been advised to exercise caution and check their credit reports, billing statements, and Explanation of Benefit statements for any sign of fraudulent activity. Patients have also been offered complimentary credit monitoring and identity theft protection services through ID Experts for 12 months.

The security breach appears to have occurred as a result of employees opening phishing emails. All staff have now received further training to help them recognize malicious emails and email security controls have been improved to prevent future attacks.

The post Email Hack Sees PHI of 53,000 Pharmacy Patients Exposed appeared first on HIPAA Journal.