HIPAA Breach News

Several Employee Email Accounts Compromised in UnityPoint Health Phishing Attack

Posted by HIPAA Journal

UnityPoint Health has discovered the email accounts of several employees have been compromised and accessed by unauthorized individuals.

Access to the employee email accounts was first gained on November 1, 2017 and continued for a period of three months until February 7, 2018, when the phishing attack was detected and access to the compromised email accounts was blocked.

Upon discovery of the phishing attack, UnityPoint Health engaged the services of a computer forensics firm to investigate the scope of the breach and the number of patients impacted. The investigation revealed a wide range of protected health information had potentially been obtained by the attackers, which included names in combination with one or more of the following data elements:

Medical record number, date of birth, service dates, treatment information, surgical information, lab test results, diagnoses, provider information, and insurance information.

The security breach has yet to appear on the Department of Health and Human Services’ breach portal, so it is currently unclear exactly how many patients have been affected by the breach. Notifications to individuals impacted by the breach started to be mailed on April 16, 2018.

To date there have been no reports of any health information being used inappropriately. However, since PHI may have been obtained by the attackers, UnityPoint Health has recommended affected individuals take steps to protect against insurance fraud an identity theft. Those steps include reviewing insurers’ Explanation of Benefits statements, monitoring accounts for fraudulent activity, and contacting insurers for a full list of all medical services paid under their insurance policy and to carefully check the list for any services that have not been received.

The incident has prompted UnityPoint Health to strengthen security controls to prevent similar incidents from occurring in the future.

The post Several Employee Email Accounts Compromised in UnityPoint Health Phishing Attack appeared first on HIPAA Journal.

Oxygen Equipment Manufacturer Discovers Credential Theft Incident Potentially Impacts 30,000

Posted by HIPAA Journal

Inogen, a manufacturer of portable oxygen concentrators, has discovered an unauthorized individual has obtained the credentials of an employee and has used them to gain access to the employee’s email account.

Phishing and other credentials theft incidents are common in the healthcare sector, although what makes this incident stand out is the number of individuals impacted by the attack. The compromised email account contained the personal information of approximately 30,000 individuals who had previously been provided with oxygen supply devices.

The types of information potentially viewed and obtained by the attacker include name, telephone number, address, email address, date of birth, date of death, types of equipment provided, Medicare ID number and health insurance information. Medical records, Social Security numbers, and payment card information were not compromised.

Also notable is the length of time it took to discover the breach. Inogen reports that access to the email account was first gained on January 2, 2018 and continued until March 14. Forensic investigators were hired to determine exactly how the breach occurred, its extent, and the number of patients impacted. The forensics firm confirmed the account was accessed and based on the IP address used to access the account, the perpetrator was located in a foreign country.

While stolen credentials were used in the attack, it is currently unclear exactly how those credentials were obtained. While phishing is a possibility, the credentials could also have been obtained by other means, such as a man-in-the-middle attack.

Since there is potential for insurance information to be misused by the attacker, Inogen has offered credit monitoring services to affected individuals and they will be protected by an insurance reimbursement policy. While that policy will cover losses in the event of insurance information misuse, Inogen has said that the policy may not cover all expenses related to the misuse of information.

Inogen is required to comply with Health Insurance Portability and Accountability Act Rules and has reported to the security breach to the Department of Health and Human Services’ Office for Civil Rights. Affected individuals have been notified by mail and relevant state attorneys general have been sent a data breach summary.

Security has been strengthened following the attack, which includes the use of two-factor authentication. If an unfamiliar device is used to access an account, a second form of authentication will be required before access to the account is granted. Additionally, all passwords have been reset, further electronic tools deployed to prevent unauthorized access, and employee training has been enhanced.

The post Oxygen Equipment Manufacturer Discovers Credential Theft Incident Potentially Impacts 30,000 appeared first on HIPAA Journal.

Integrated Rehab Consultants Takes 16 Months to Notify Patients of PHI Breach

Posted by HIPAA Journal

The Chicago, IL-based physiatry group Integrated Rehab Consultants is sending notification letters to certain patients alerting them to the exposure of some of their protected health information, as is required by HIPAA. However, the breach was not discovered in the past 60 days. Integrated Rehab Consultants (IRC) first became aware of the exposure of PHI on December 2, 2016 – 16 months ago.

The data – which included patients’ full names, address, date of birth, gender, medical provider information, visit date, visit status, admission date, appointment visit ID, treatment location, procedure code, and diagnosis codes – had been uploaded to a publicly accessible repository. The PHI was discovered by a healthcare security researcher who notified IRC about the breach.

Prompt action was taken to remove and secure the data and an investigation was launched to determine how and why the data had been uploaded to an insecure location. That investigation determined that a business associate who had been provided with the PHI had disclosed the information to a third party. It was that subcontractor that made the error and uploaded the data to the public repository.

At the time, IRC only believed the data had been accessed by the security researcher. However, in its substitute breach notice, IRC explained that in the fall of 2017 it became apparent that other individuals may also have gained access to the data.

Patients potentially impacted have been offered complimentary credit monitoring and identity restoration services for 12 months without charge and notified about the incident ‘out of an abundance of caution.’ ICR has not received any reports to suggest any patient information has been misused, although affected individuals have been urged to check their credit reports and EoB statements carefully and to remain vigilant against incidents of identity theft and fraud.

It is unclear why patients were not notified of the exposure of their PHI within 60 days of the initial discovery that their PHI had been exposed, nether why there was a further delay in issuing notifications when it was suspected that other individuals may have gained access to the data.

The post Integrated Rehab Consultants Takes 16 Months to Notify Patients of PHI Breach appeared first on HIPAA Journal.

Baptist Health Alerts Almost 1,500 Patients to Possible Abuse of Credit Card Details

Posted by HIPAA Journal

A former employee of Baptist Health’s West Kendall Baptist Hospital in Miami, FL has been discovered to have stolen the credit card details of at least one patient and used the information to make fraudulent purchases.

The misuse of credit cards was discovered by Baptist Health on March 9, 2018 and the matter was referred to Miami-Dade law enforcement and the employee was terminated.

Baptist Health has not specified exactly how many patients have been confirmed to have been defrauded by the employee, although 1,480 patients have been sent breach notification letters to alert them to the possibility that their credit card details may have been misused.

Any patient who paid for medical services using a credit card with the registration employee between August 2014 and March 2018 have potentially had their name, date of birth, and credit card details stolen and misused.

As a precaution, all 1,480 patients have been offered identity theft protection and credit monitoring services for 12 months without charge and have been advised to check their credit card statements carefully for any unauthorized purchases.

Baptist Health is exploring options to further protect patient health information and prevent any further breaches of this nature from occurring in the future.

The post Baptist Health Alerts Almost 1,500 Patients to Possible Abuse of Credit Card Details appeared first on HIPAA Journal.

63,500 Patients Impacted by Middletown Medical Data Breach

Posted by HIPAA Journal

A misconfigured security setting on a radiology interface has resulted in the exposure of tens of thousands of patients’ protected health information.

Middletown Medical, a multi-specialty physicians’ group based in Middleton, NY, discovered the misconfigured security setting on January 29, 2018.

The following day the interface was secured to ensure unauthorized individuals were prevented from accessing patient information. It is unclear for how long patient data was accessible. Middletown Medical says only a limited number of patients’ PHI could have been accessed by unauthorized individuals.

Highly sensitive information such as financial data, Social Security numbers, and insurance information were not exposed. The breach was limited to names, client identification numbers, birth dates, confirmation that radiology services had been received by patients, and the dates those services were provided. A limited number of patients also had diagnosis codes, radiology images, and radiology reports exposed.

The discovery of the error prompted Middletown Medical to review its polices and procedures and implement additional safeguards to ensure the confidentiality of documents containing PHI. Additional training has been provided to staff on securing information systems and modifications have been made to interfaces to ensure all information remains secure.

No reports of misuse of PHI have been received although, out of an abundance of caution, all patients impacted by the breach have been offered complimentary identity theft recovery services for 12 months and have been advised to carefully review their account statements and Explanation of Benefits statements for any sign or fraudulent activity.

The data breach summary submitted to the Department of Health and Human Services’ Office for Civil Rights indicates up to 63,551 patients had their PHI exposed, making this one of the largest healthcare security incidents to be reported so far this year.

The post 63,500 Patients Impacted by Middletown Medical Data Breach appeared first on HIPAA Journal.

2 to 6 Year Jail Term for Receptionist Who Stole PHI from Dentist Office

Posted by HIPAA Journal

A former receptionist at a New York dental practice has been sentenced to serve 2 to 6 years in state penitentiary for stealing the protected health information of hundreds of patients.

Annie Vuong, 31, was given access to the computer system and dental records of patients in order to complete her work duties. Vuong abused the access rights and stole the PHI of more than 650 patients. That information was passed to her co-defendants who used the data to steal identities and make fraudulent purchases of high value items.

Vuong was arrested on February 2, 2015, following a two-and-a-half-year investigation into identity theft by the New York District Attorney’s Office.

The theft of data occurred between May and November 2012, when the PHI of 653 patients was taken from the dental office. The types of information stolen included names, birth dates, and Social Security numbers. That information was shared with co-defendant Devin Bazile in an email.

Bazile used the information to obtain credit lines from Barclaycard in the victims’ names. Credit ranged from $2,000 to $7,000 per individual. Bazile along with co-defendants Joshua Hamilton and Ahmeen Evans used the credit to purchase Apple gift cards that were used by buy tablets and laptop computers totaling more than $700,000.

Bazile and Haughton had already been convicted and sentenced to lengthy jail terms for their role in the identity theft scheme. Bazile and Haughton were convicted of Grand Larceny in the Second Degree in 2015 and were sentenced to serve 3 to 9 years and 1 and 1/3 to 4 years in jail respectively. Evans was also convicted of Grand Larceny in the Second Degree and was sentenced to 5 years’ probation.

Vuong was found guilty of 189 counts against her including one count of Grand Larceny in the Second Degree, 49 counts of Grand Larceny in the Third Degree, 63 counts of Identity Theft in the First Degree, 45 counts of Grand Larceny in the Fourth Degree, 30 counts of Identity Theft in the Second Degree, and one count of Unlawful Possession of Personal Identification Information in the Second Degree.

The post 2 to 6 Year Jail Term for Receptionist Who Stole PHI from Dentist Office appeared first on HIPAA Journal.

Chesapeake Regional Healthcare Reports PHI of 2,100 Patients Was Stored on Lost Hard Drives

Posted by HIPAA Journal

Body:

Chesapeake Regional Healthcare has discovered two hard drives containing the protected health information (PHI) of approximately 2,100 patients are missing from the Chesapeake Regional Medical Center campus in Chesapeake, Virginia.

The data stored on the devices relates to individuals who took part in studies at its Sleep Center between April 2015 and February 2018.

It is currently unclear exactly when the hard drives went missing. Chesapeake Regional Healthcare discovered the devices were missing on February 6, 2018. An internal investigation was launched, and a full search of the facility was conducted, but the devices could not be located. The missing hard drives have been reported as lost/stolen to law enforcement, but Chesapeake Regional Healthcare said the probability of the devices being recovered is low and it does not expect the devices to be found.

The hard drives were not encrypted. If obtained by a third party, the protected health information of patients could potentially be accessed. The types of information stored on the devices includes names, demographic information, birth dates, unique patient identifiers, details of the procedures and tests performed at the Sleep Center, and information on medications that were prescribed. Social Security numbers, addresses, insurance information, and financial data were not stored on the device.

Chesapeake Regional Healthcare is taking steps to ensure similar breaches do not occur in the future. Those steps include improving policies related to the security of PHI stored on portable electronic devices. It is not clear whether the new measures will include data encryption.

Chesapeake Regional Healthcare is currently in the process of sending notifications to patients, who are being offered 12 months of complimentary credit monitoring and identity theft protection services. In the event that patients discover their health information has been used inappropriately, assistance will be offered to help mitigate any harm caused.

The post Chesapeake Regional Healthcare Reports PHI of 2,100 Patients Was Stored on Lost Hard Drives appeared first on HIPAA Journal.

Oregon Data Breach Notification and Information Security Laws Updated

Posted by HIPAA Journal

Oregon has updated its data breach notification law to improve protections for state residents whose personal information is exposed in a data breach. State governor Kate Brown added her signature to Senate Bill (SB 1551) last month, which updates several regulations, notably Oregon’s Breach Notification Law, O.R.S. 646A.604 and Information Security Law, O.R.S. 646A.622. The updates will become effective in June 2018.

Prior to the update, Oregon data breach notification law only applied to persons who own or license personal information. Now, the definition of a person is “an individual, private or public corporation, partnership, cooperative, association, estate, limited liability company, organization or other entity, whether or not organized to operate at a profit, or a public body as defined in ORS 174.109.”

A data breach is defined as “an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that a person maintains.”

The definition of personal information has been expanded to include a first name or first initial and last name, in combination with any of the following data elements:

  • Social Security number
  • Driver’s license number
  • State identification card number from the Department of Transportation
  • Passport number
  • Other U.S. identification numbers
  • Data from automatic measurements of physical characteristics (including iris and retina scans and fingerprints) that are used to authenticate transactions
  • A health insurance policy number or subscriber ID number in combination with any unique identifier that can identify an individual
  • Details of mental or health conditions
  • Medical histories
  • Financial information that includes an access code or passwords that would permit an unauthorized individual to gain access to the financial account

While timely notifications were required when personal information was exposed or stolen as a result of a security breach, there is now a maximum time frame for issuing notifications. Notifications must be issued without unreasonable delay, but no later than 45 days following the discovery of a breach. Breach notifications can be delayed at the request of law enforcement if the issuing of notifications would impede an investigation.

While there is some overlap between the definition of personal information under state law and the definition of protected health information under HIPAA, HIPAA-covered entities are exempt from complying with the 45-day breach notice deadline and are deemed to be in compliance with that aspect of state law if they meet the requirements of the HIPAA Breach Notification Rule and issue notifications no later than 60 days from the discovery of a breach. All breached entities, including HIPAA covered entities, must send a copy of the consumer breach notice to the Oregon attorney general if the breach impacts more than 250 individuals.

The update also introduced the requirement that credit monitoring services and identity theft protection services cannot be conditioned on accepting any other services that require a fee to be paid, and neither should require the provision of a credit or debit card. The law does not require a breached entity to provide these services in the event of a breach of personal information.

The update to Information Security Law, O.R.S. 646A.622 requires “a person that owns, maintains or otherwise possesses,  or  has  control  over  or access  to, data that includes a  consumer’s personal information that the person uses in the course of the person’s business, vocation, occupation or volunteer activities” to implement and maintain reasonable safeguards to protect the confidentiality, integrity, and security of personal information.

HIPAA-covered entities will be deemed to be in compliance with that aspect of O.R.S. 646A.622 provided they are in compliance with HIPAA 45 C.F.R. 160 and 164.

The post Oregon Data Breach Notification and Information Security Laws Updated appeared first on HIPAA Journal.

Verizon PHI Breach Report Confirms Healthcare Has Major Problem with Insider Breaches

Posted by HIPAA Journal

Verizon has released its annual Protected Health Information Breach Report which delves deep into the main causes of breaches, why they occur, the motivations of internal and external threat actors, and the main threats to the confidentiality, integrity, and availability of PHI.

For the report, Verizon analyzed 1,368 healthcare data breaches and incidents where protected health information (PHI) was exposed but not necessarily compromised. The data came from 27 countries, although three quarters of the breached entities were based in the United States where there are stricter requirements for reporting PHI incidents.

In contrast to all other industry sectors, the healthcare industry is unique as the biggest security threat comes from within. Insiders were responsible for almost 58% of all breaches with external actors confirmed as responsible for just 42% of incidents.

The main reason for insider breaches is financial gain. PHI is stolen to commit identity theft, credit card fraud, insurance fraud, and tax fraud. Verizon determined that 48% of all internal incidents were conducted for financial gain. 31% involved accessing medical data out of curiosity or for fun, 10% of incidents were attributed to easy access to data, with 3% of incidents occurring due to a grudge and a further 3% for espionage. External attacks are primarily conducted for financial gain – extortion and the theft and sale of data.

Verizon also looked at the actions that lead to PHI incidents and data branches, with the most common problem being errors. Errors were behind 33.5% of incidents within this category, which included the misdelivery of emails and mailings, errors made disposing of PHI, publishing errors, loss of PHI, misconfigurations, programming mistakes and data entry errors. The main incident cause was misdelivery of documents, which accounted for 20% of all incidents in the error category.

The second biggest breach category is misuse, accounting for 29.5% of all incidents. 66% of incidents in this category were attributed to privilege abuse – accessing records without authorization. Data mishandling was behind 21.6% of incidents and possession abuse – the misuse of access to physical records – was behind 16.9% of incidents in the misuse category.

The physical category includes theft of records and devices, snooping, tampering, disabled controls, and surveillance. 16.3% of all healthcare PHI incidents were placed in this category, with theft accounting for 95.2% of all incidents. The theft of laptops was the main incident type. Almost half (47%) of laptop theft incidents involved the devices being taken from employees’ vehicles. The use of encryption would prevent the majority of these incidents from exposing PHI.

Hacking may make the headlines, but it accounted for relatively few breaches – just 14.8% of all healthcare PHI incidents were placed in this category. The main cause of breaches in the hacking category was the use of stolen credentials (49.3% of incidents), with credentials often stolen via phishing attacks. Brute force attacks taking advantage of weak passwords were behind 20.9% of incidents. 17.9% of hacking breaches involved the use of backdoors.

Malware was involved in 10.8% of all PHI incidents. While there were a wide range of malware types and variants used in attacks, by far the biggest category was ransomware, which accounted for 70.5% of attacks.

Social attacks accounted for 8% of all incidents. This category involves attacks on employees. Phishing was involved in 69.9% of incidents in this category, followed by pretexting (11.7%), and bribery (7.8%). Pretexting is the next stage on from phishing, when access to email accounts is used to send further emails – BEC attacks for example.

Verizon offers three suggestions which in the short term will help to reduce the number of PHI related incidents and data breaches.

Full disk encryption should be deployed on all portable electronic devices used to store PHI. This simple measure would prevent PHI from being accessed in the event of loss or theft of an electronic device.

The routine monitoring of medical record access – a requirement of HIPAA – will not prevent breaches, but it will reduce the severity of insider incidents and allow healthcare organizations to take corrective action quickly. When employees are aware that records are routinely monitored it can also act as a deterrent and reduce theft and unauthorized access incidents.

The final course of action is to implement solutions to combat ransomware and malware. While defenses can and should involve the use of spam filters and web filters, simple measures can also be taken such as not allowing laptops to access the Internet if they are used to store large quantities of PHI.

The post Verizon PHI Breach Report Confirms Healthcare Has Major Problem with Insider Breaches appeared first on HIPAA Journal.