A laptop computer containing the protected health information of 2,553 patients of Eye Care Surgery Center, Inc., of Baton Rouge, LA has been stolen.

The theft was discovered by Eye Care Surgery Center on February 26, 2018. While there is no mention of where the device was stolen from in the company’s substitute breach notice, the actions taken following the breach suggest the device was taken from its facilities rather than the vehicle of an employee.

The theft prompted Eye Care Surgery Center to install a new multi-camera system at its facilities, both inside and outside buildings. The decision has also been taken to use encryption on most of the portable electronic devices used by Eye Care Surgery Center to prevent any future theft incidents from exposing any protected health information.

An investigation was conducted to determine the types of information stored on the device and the patients affected by the incident. Highly sensitive information such as health insurance information, Social Security numbers, and financial information were not stored on the device. The breach was limited to names, birth dates, and diagnosis information. No reports have been received to suggest any of the information stored on the device have been misused.

Affected individuals have now been notified of the breach by mail and the incident has been reported to the Department of Health and Human Services’ Office for Civil Rights.

The post Eye Care Surgery Center Data Breach Impacts 2,553 Patients appeared first on HIPAA Journal.

An oversight has caused a database used by Cerebral Palsy Research Foundation of Kansas (CPRF) to have its security protections removed for a period of 10 months, exposing the protected health information (PHI) of 8,300 patients.

The vulnerable demographic database was discovered on March 10, 2018 and was immediately secured. The investigation into the breach determined that while the database had been created on a secure subdomain in early 2000, when CPRF switched its servers in 2017 the database was not identified resulting in the accidental removal of security protections. During the time that the database was vulnerable it is possible that personal and health information was accessed by unauthorized individuals.

The breach was limited to personal information and personal health information relating to the type of disability suffered by patients. No financial information or donor information was exposed. Individuals affected by the breach had received services from CPRF between 2001 and 2010.

It is unclear whether any of the exposed information was accessed by unauthorized individuals during the time that the database was left unsecured. Out of an abundance of caution, CPRF is offering all affected individuals one year of credit monitoring and identity theft protection services free of charge.

As part of its investigation and vulnerability remediation efforts, CPRF performed a complete audit of all domains, subdomains, and databases and discovered no further vulnerabilities existed. Data security policies have now been reinforced as have policies and procedures related to employee transitions to prevent future errors which could potentially lead to the exposure of PHI. CPRF has also contracted a third-party to perform regular vulnerability scans and penetration tests.

All affected individuals have been notified of the privacy breach by mail and a breach report has been submitted to the Department of Health and Human Services’ Office for Civil Rights.

The post 8,300 Cerebral Palsy Research Foundation of Kansas Patients Informed of 10-Month Exposure of PHI appeared first on HIPAA Journal.

The Silver Spring, MD-based gastroenterology group Capital Digestive Care has discovered one of its business associates uploaded files to a commercial cloud server that lacked appropriate security controls, exposing the protected health information of up to 17,639 patients.

The availability of sensitive patient data over the Internet was brought to the attention of Capital Digestive Care on February 23, 2018 and action was promptly taken to secure the files and prevent further unauthorized access.

An investigation into the privacy breach was launched to determine the types of information that had been exposed and the number of patients impacted.

The investigation confirmed some sensitive data had been exposed, although the breach was limited to individuals that had visited its website and submitted information via the Schedule a Visit and Contact pages on the site.

The types of information exposed was limited to names, addresses, email addresses, telephone numbers, and birth dates. Patients may also have had a limited amount of health information exposed. The login page to the patient portal and the Pay a Bill pages were unaffected, so no financial information was exposed. No patient accounts were compromised and Social Security numbers and electronic health records remained secure at all times.

Capital Digestive Care has taken steps to prevent further breaches of PHI. All third-party vendors are now required to confirm compliance with HIPAA Security Rule provisions concerning the secure storage of personal data.

All patients impacted by the incident have been notified by mail and provided with information on monitoring and protecting their personal information.

It is unclear for how long patient data were exposed and how many unauthorized individuals viewed patient information.

Capital Digestive Care has not received any reports to suggest the exposed information has been obtained by unauthorized individuals or misused.

The post Capital Digestive Care Notifies 17,639 Individuals of PHI Exposure appeared first on HIPAA Journal.

University of Arkansas Medical Sciences (UAMS) has fired three employees over alleged HIPAA violations that saw a patient’s protected health information impermissibly disclosed and published on Facebook.

UAMS provides training to all employees to make them aware of their responsibilities with respect to patient privacy and the requirements of HIPAA, yet despite that training, one employee violated the privacy of a patient by disclosing that individual’s name, age, HIV status, employment information, and surgical history to a colleague.

That employee shared the information with a friend who uploaded the PHI to Facebook. A third employee allegedly played no part in the violation but was aware of the disclosures yet failed to report the incident to the hospital.

The hospital took prompt action when the HIPAA violations were discovered and terminated all three employees for violating HIPAA Rules and the hospital’s code of conduct. The hospital is taking steps to ensure similar incidents are prevented and is working with the patient to resolve the privacy violation.

The motives of the employees are unclear, but their responsibilities to ensure patient privacy was protected had been clearly explained and there can be no doubt that they were aware that their actions were in breach of federal regulations.

In addition to losing their jobs, the matter has been referred to the U.S. attorney’s office and criminal charges for the HIPAA violation are being considered.

The privacy violation should serve as a warning to all healthcare employees about the potential repercussions of HIPAA violations, and also that the failure to report a HIPAA violation by a co-worker could also result in loss of employment.

If a HIPAA violation is discovered in the workplace, the incident should be reported to the organization’s privacy officer to ensure prompt action can be taken to limit the harm caused.

The post 3 University of Arkansas Medical Sciences Employees Fired for Violation of Patient Privacy appeared first on HIPAA Journal.

The quarterly breach barometer report from Proteuns provides interesting insights into the extent to which insiders are violating HIPAA Rules and snooping on patient health information.

The Breach Barometer report is compiled using breach data supplied by Databreaches.net and proprietary data collected through the artificial intelligence platform developed by Protenus that allows healthcare organizations to track and analyze employee HER activity.

Insider breaches are a major problem in healthcare, yet many insider breaches go undetected. When insider breaches are identified, it is often months after the breach has occurred. One healthcare employee was recently discovered to have been accessing medical records without authorization for 14 years.

1.13 Million Patient Records Exposed in Q1, 2018

The latest Breach Barometer report shows the records of 1,129,744 patients and health plan members has been viewed by unauthorized individuals, exposed, or stolen in the first quarter of 2018. Data breaches occurred at a rate of more than one per day, with 110 healthcare data breaches reported in Q1.

Data breaches are typically only announced publicly if they have affected more than 500 individuals. Smaller data breaches still need to be reported to the HHS’ Office for Civil Rights to comply with HIPAA Rules, although the information is not made available to the public.

An analysis of the data collected from the Protenus platform suggests only one thousandth of data breaches are actually disclosed to the public, and inappropriate accessing of medical records by healthcare employees is a major problem throughout the industry.

Most commonly, healthcare employees snoop on the medical records of family members. 77.10% of all insider snooping incidents in Q1, 2018 involved the unauthorized accessing of family members’ health records. In second place was inappropriate accessing of co-workers’ health records, followed by snooping on neighbors’ health information and VIPs’ medical records.

The Protenus report shows just how important it is to detect these incidents promptly to prevent further privacy violations. Data analyses by Protenus show there is a 20% chance that a healthcare employee will inappropriately view medical records again within three months of the first incident, and a 54% chance that they will repeat the violation at least once in the following 12 months. “Healthcare organizations accumulate risk that compounds over time when proper detection, reporting, and education do not occur,” said Kira Caban, Protenus Director of Public Relations.

Unfortunately, most healthcare providers lack visibility into who is accessing medical records and privacy violations take many months to detected. The average time take to identify a breach of patient privacy is 244 days.

The Quarterly Breach Barometer report can be downloaded on this link.

The post Protenus Report Highlights Extent of Insider Breaches in Healthcare appeared first on HIPAA Journal.

An unauthorized individual has gained access to the email account of an employee of Scenic Bluffs Community Health Centers and potentially viewed the protected health information of up to 2,9889 patients.

The email account breach was discovered by the health centers on March 1, 2018, the day after access to the account was gained. The attacker had set up a mail forwarder on the account, which had forwarded 44 messages to an email address controlled by the attacker.

None of the forwarded emails contained any protected health information and following the discovery of the mail forwarding rule it was deleted, the account was closed, and all PHI was secured. While no PHI appeared to have been obtained by the attacker, it is possible that during the time that access to the email account was possible, PHI detailed in the emails could potentially have been viewed.

It is unclear how access to the email account was gained. Typically email accounts are compromised after employees respond to phishing emails and inadvertently disclose their login credentials, or via brute force attacks that take advantage of weak passwords.

Scenic Bluffs Community Health Centers has hired an external cybersecurity firm to evaluate its systems and provide recommendations on suitable security solutions that can be deployed to further protect patient privacy and prevent future security breaches.

Breach notification letters were mailed on April 23 to patients whose PHI was potentially viewed.

The post 2,889 Patients of Scenic Bluffs Community Health Centers Notified of PHI Breach appeared first on HIPAA Journal.

Maximus Inc, a provider of business process management and technology solutions to government health and human services agencies, is alerting more than 3,000 individuals that some of their protected health information has been accidentally disclosed to other individuals as a result of a printing error on a recent mailing.

The mailing was prepared and sent by its business associate, Business Ink, between February 10 and February 13, 2018. The mailing was sent to approximately 1,100 families in Texas who participated in Medicaid and the Children’s Health Insurance Program (CHIP). The error was discovered by Maximus on February 16.

The 6-page letter included one mismatched page that included information relating to another individual. The types of information detailed on the page were limited to names, addresses, group numbers, case numbers, and program type. No highly sensitive information such as Social Security numbers, birth dates, insurance information, or financial information was exposed, and none of the information detailed on the mismatched pages would allow another individual to gain access to another person’s program account.

Since the information exposed was extremely limited, affected individuals do not need to take any action to mitigate risk. Notifications were issued out of an abundance of caution.

Maximus has investigated the incident and has received assurances that its mailing vendor has strengthened its printing processes to ensure similar errors are prevented in the future. No reports have been received to suggest any of the disclosed information has been misused in any way.

According to Databreaches.net, 3,029 individuals had information impermissibly disclosed as a result of the printing and mailing error.

The post PHI of 3,000 Patients Exposed Due to Mailing Printing Error appeared first on HIPAA Journal.