Oklahoma State University Center for Health Sciences (OSUCHS) has discovered an unauthorized individual has gained access to parts of its computer network and potentially accessed files containing billing information of Medicaid patients.

The security breach was discovered on November 7, 2017 with access to the network terminated the following day. Third party computer forensics experts were called upon to conduct a comprehensive investigation to determine which parts of the network had been accessed, and whether patient health information had been accessed or stolen.

The investigation confirmed that patient health information could potentially have been viewed, although it was not possible to determine whether patient information had been accessed or stolen. OSUCHS reports that it has not received conclusive information to suggest any patient information has been misused.

Out of an abundance of caution, all individuals potentially impacted by the incident have been notified of the breach by mail and advised that they should be alert to the possibility that their personal information could potentially be misused.

OSUCHS says medical records were not compromised and the breach was limited to names, healthcare provider names, Medicaid numbers, dates of service, and a limited amount of treatment information. Only one Social Security number was present on the compromised server.

The breach has prompted OSUCHS to conduct a review of security protections and additional measures have now been implanted to better protect patient information in the future.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal so it is currently unclear exactly how many individuals have been impacted.

The post Oklahoma State University Center for Health Sciences Informs Patients of PHI Breach appeared first on HIPAA Journal.

The Agency for Health Care Administration in Florida has discovered an unauthorized individual has gained access to a single email account as a result of an employee falling for a phishing scam.

The employee received and responded to the malicious phishing email on November 15, 2017 and disclosed login credentials that allowed the attacker to remotely access his/her email account and, potentially, the protected health information of as many as 30,000 Medicaid enrollees.

The agency discovered the security breach on November 20 and performed a password reset to prevent further access. The incident was also reported to the agency’s inspector general, who launched an investigation into the attack. Preliminary findings of that investigation were released late last week.

According to an agency press release issued on Friday, the unauthorized individual may have partially or fully accessed information such as names, Medicaid ID numbers, addresses, dates of birth, diagnoses, medical conditions, and Social Security numbers. Approximately 6% of individuals impacted by the incident had either their Medicaid ID or Social Security number exposed.

While data access was possible, Florida’s Agency for Health Care Administration has not uncovered any evidence to suggest the compromised protected health information has been misused. Since sensitive information has potentially been viewed and stolen, individuals impacted by the incident have been told to be vigilant and check their accounts for signs of fraudulent activity. All individuals impacted by the breach have been offered complimentary credit monitoring services for 12 months.

Prior to the phishing attack, the Florida Agency for Health Care Administration had implemented an ongoing staff training program, although the incident has prompted a review of that program and staff have now been reeducated on proper security protocols and the dangers of phishing. The agency is also considering additional security controls to reduce the risk from phishing in the future.

The post Phishing Attack on Florida Agency for Health Care Administration Impacts 30,000 Medicaid Recipients appeared first on HIPAA Journal.

Compassionate Care Hospice Las Vegas (CCHLV) has discovered an unauthorized individual gained access to its network and server and potentially viewed 1,128 patients’ protected health information.

On October 28, 2017, CCHLV discovered its network had been accessed by an unauthorized individual. Upon discovery of the breach, CCHLV hired third-party forensics experts to conduct a thorough investigation to determine the nature of the breach and to identify all patients who were potentially affected.

While the investigation confirmed access to data was possible, no evidence was uncovered to suggest any sensitive information was viewed or stolen by the attacker. However, it was not possible to rule out data access and theft with 100% certainty.

The types of information stored on the parts of the network that could have been accessed included names, dates of birth, addresses, Medicare numbers, medical treatment information, health insurance information, and archived electronic health records. Financial information was not stored on the part of the network compromised in the attack and remained secure at all times.

Once access to the network and server had been blocked, CCHLV conducted a comprehensive risk analysis to identify potential vulnerabilities to the confidentiality, integrity, and availability of PHI and has reviewed and revised network security policies accordingly. To ensure that any future cyberattacks are detected and mitigated rapidly, CCHLV has now implemented intrusion detection and monitoring systems.

CCHLV notified all affected individuals by mail on December 14, 2017 and reported the incident to the Department of Health and Human Services’ Office for Civil Rights. Upon discovery of the attack, law enforcement was notified and CCHLV is continuing to assist with the investigation.

Out of an abundance of caution, all patients impacted by the breach have been offered complimentary credit monitoring and identity theft restoration services for 12 months through Kroll.

The post Compassion Care Hospice Hack Impacts 1,128 Patients appeared first on HIPAA Journal.

Kaiser Permanente has experienced two security incidents which have recently been reported to the Department of Health and Human Services’ Office for Civil Rights. In total, more than 5,000 individuals have been impacted by the breaches.

Both breaches affect members of the Kaiser Foundation Group Health Plan. The most serious incident, in terms of the number of individuals impacted, was an email-related breach affecting 4,389 health plan members in the San Bernardino County area of Southern California.

An unauthorized individual was discovered to have gained access to the email account of a Southern California Permanente physician, which contained a limited amount of protected health information.

Kaiser Permanente conducted an extensive investigation to determine the nature and full extent of the breach. While the email account was accessed, Kaiser Permanente believes the risk to plan members is low due to the nature of data contained in the email account.

The email account did not contain highly sensitive information such as bank account details, credit card numbers, insurance information, or Social Security numbers. The breach was limited to plan members’ names, ages, dates of service, medical record numbers, phone numbers, limited medical information, and flu shot data.

Affected members have been informed of the breach by mail and Kaiser Permanente is exploring additional technology that can be implemented to prevent similar breaches from occurring in the future.

One week later, Kaiser Permanente reported a second breach, this time involving the PHI of 638 plan members. The second breach occurred between October 9 and October 13, 2017 and was a mis-mailing incident. Letters containing a limited amount of protected health information were sent to incorrect plan members in the West Los Angeles area.

No Social Security numbers, medical record numbers, financial information, or other highly sensitive information was involved. Affected members have been notified and mailing workflow processes have been reviewed and updated to prevent a recurrence.

The post Kaiser Permanente Reports Two Security Incidents Impacting 5,000 Members appeared first on HIPAA Journal.

The St. Louis, MO-based not-for-profit health system SSM Health has discovered a former employee has been accessing the health records of patients without any legitimate work reason for doing so for 8 months.

The former employee worked in SSM Health’s customer service call center, and as such, did not have access to financial information, only demographic, health, and clinical information.

The improper access was detected by SSM health on October 30, prompting a thorough investigation to determine the records that had been accessed and which patients were potentially at risk. The investigation revealed the records of patients in multiple states were accessed by the employee between February 13 and October 20, 2017.

The employee was primarily interested in the records of patients of a primary care physician in the St. Louis area, specifically patients who had been prescribed a controlled substance. While that subset of patients was relatively small, it was not possible to determine the full scope of the privacy breach, so SSM Health took the decision to notify all patients whose records had been accessed by the former employee. In many cases, that access will have been for legitimate work purposes.

In total, 29,000 patients have been notified of the incident and warned that their protected health information may have been improperly accessed and could potentially have been misused. Those patients have been offered identity theft protection services without charge.

SSM Health has also changed its procedures to require an additional identifier to be used when patients request prescription refills via its call center. Internal policies and procedures have been reviewed and employee access monitoring tools have been strengthened to ensure any future illegal employee activity is identified more rapidly.

The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights and law enforcement has been notified.

SSM Health privacy officer, Scott Didion, said, “We take very seriously our role of safeguarding our patients’ personal information, and we deeply regret any inconvenience or concern this situation may have caused our patients.”

This is the second incident to be reported by SSM Health this year. In May, SSM Health reported that an electromyography device containing the PHI of 836 patients had been stolen from DePaul Hospital St Louis in Bridgeton, MO.

The post 29,000 Patients Notified of Employee-Related Data Breach at SSM Health appeared first on HIPAA Journal.

A family and sports medicine practice in Colorado has discovered a hacker gained access to its systems and encrypted files with ransomware.

Longs Peak Family Practice (LPFP) in Longmont CO, identified suspicious activity on its network on November 5, 2017 and took rapid action to secure its systems. However, before that was possible, the attacker ran ransomware code which encrypted files on certain parts of its network.

LPFP was prepared for such attacks, and was able to recover the encrypted files and rebuild its systems from backups. However, five days after the initial intrusion was detected, LPFP discovered a second attack had occurred, and its systems had been accessed in a second attack. Ransomware was not involved in the second incident.

While the first incident was dealt with internally, when the second attack was discovered, LPFP called in a leading computer forensics form to assist with the investigation, conduct scans for malware and backdoors, and ensure that unauthorized access to its systems was blocked.

That investigation revealed that an unauthorized individual had accessed certain parts of LPFP’s network on November 5, 9, and 10^th. The forensic investigation took until December 5 to complete, but did not uncover any specific evidence to suggest the attacker had opened any files or stolen data.

However, it was not possible to rule out data access and theft with 100% certainty, and while no evidence was uncovered to suggest the ransomware infection did anything other than blindly encrypt files, it is possible that the malware could have been used to download some computer files.

Files stored on the compromised computers included the following patient information: Names, addresses, email addresses, driver’s license details, Social Security numbers, dates of birth, internal patient ID numbers, insurance carriers, insurance payment codes and costs, dates of service, copies of notes made by LPFP physicians and other healthcare providers, medical conditions, medications, diagnoses, data from diagnostic studies, and lab test results.

Potentially, final statements for accounts that had been sent to a collection agency may have been compromised, but no financial information, invoices for medical services, or credit/debit card details were exposed.

LPFP had already implemented a range of defenses to prevent the unauthorized accessing of patient data, but these attacks revealed vulnerabilities existed in its defenses.  Those vulnerabilities have now been addressed and changes have been made to how its network can be accessed. A new, enhanced firewall has been purchased and implemented, further training is being provided to staff on privacy and security, and the practice is looking into further tools and procedures that will help to improve security.

Due to the sensitive nature of the information that was potentially accessed, LPFP is offering patients 12 months of identity theft repair and credit monitoring services through AllClear without charge.

The post Colorado Practice Hacked Twice in a Week appeared first on HIPAA Journal.

University of Rochester Medicine’s Jones Memorial Hospital in Wellsville, NY is currently experiencing a cyberattack that has caused unexpected downtime.

The attack is understood to have started on Wednesday December 27 and has caused disruption to some of its information services. At the time of writing, the nature of the cyberattack is unclear and it has yet to be resolved.  The cyberattack is limited to Jones Memorial Hospital. No other locations have been impacted.

While some systems are unavailable, Jones Memorial Hospital has announced on its website that the financial and medical information of its patients does not appear to have been compromised. If the investigation concludes that there has been a breach of health information, patients will be notified accordingly. Further information on the attack will also be posted on the hospital’s website as and when new information becomes available.

The hospital notified law enforcement and the New York State Department of the attack when its systems went down. Hospital IT staff are being assisted by the IT departments at the University of Rochester, St. James Hospital, and Noyes Health to restore all systems back to full functionality.

Jones Memorial Hospital has prepared for incidents such as this. Emergency procedures are regularly tested, and employees are trained how to respond to cyberattacks and system downtime. Consequently, medical services are continuing to be provided, with information being recorded manually on patient charts while its systems are offline.

However, without access to electronic patient health information, the hospital is advising all patients to bring their insurance card with them, as well as full lists of medications and if possible, details of their medical history.

Systems will be brought back online as soon as is possible, but in the meantime, the hospital is focused on maintaining patient safety and quality of care.

The post Jones Memorial Hospital Alerts Patients to Ongoing Cyberattack appeared first on HIPAA Journal.