An unencrypted laptop computer issued to an employee of Clinical Pathology Laboratories Southeast, Inc., (CPLSE) has been stolen, exposing the protected health information of certain patients and their payment guarantors.

Prompt action was taken by CPLSE to prevent the laptop from being used to connect to its network and the theft was reported to law enforcement; however, it is possible that the protected health information stored on the laptop could have been viewed by unauthorized individuals.

An internal investigation was conducted to determine the types of information stored on the device which indicated the following PHI elements were potentially exposed: Names, addresses, driver’s license numbers, Social Security numbers, government ID numbers, medical record numbers, and medical treatment information.

Patients have now been notified of the breach and advised of the steps they can take to protect themselves against misuse of their data. Complimentary credit monitoring and identity theft protection services have been offered to affected individuals.

Steps have also been taken to prevent similar incidents from occurring in the future, which include retraining staff on data security, updating appropriate policies and procedures, and using encryption technology on portable electronic devices used to store ePHI.

The laptop was stolen on September 20, 2017 and the substitute breach notice uploaded to the CPLSE website on March 21, 2018. It is unclear why it took 6 months for the incident to be announced. HIPAA requires notifications to be issued within 60 days of the discovery of a breach.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights Breach Portal. The number of individuals affected has not yet been confirmed.

The post Theft of Unencrypted Laptop Sees Pathology Lab Patients’ PHI Exposed appeared first on HIPAA Journal.

Geneva, NY-based Finger Lakes Health has experienced a ransomware attack that has crippled its computer system. Staff have been forced to work on pen and paper while the health system attempts to remove the malware and restore access to electronic data.

The ransomware attack on the health system started at around midnight on Sunday March 18, 2018, with staff becoming aware of the attack when a ransom demand was issued by the attackers.

Finger Lakes Health operates Geneva General Hospital and Soldiers & Sailors Memorial Hospital in Pen Yan and several specialty care practices, primary care physician practices, long-term health facilities, and day care centers in upstate New York. It is unclear exactly how many facilities have been impacted by the ransomware attack.

Finger Lakes Health has developed emergency procedures for attack scenarios such as this, which were immediately implemented when the attack was discovered. On March 20, the health system issued a statement to local media channels about the attack explaining that while some of its information systems were inaccessible, its manual downtime protocol had been implemented and its hospitals and care facilities continued to function. Such an attack will naturally have an impact on the provision of medical services, although patient care remains the main priority while the ransomware attack is mitigated.

Finger Lakes Health is working closely with law enforcement and IT teams to restore access to data and bring its systems back online. At this stage it appears that the attackers have only encrypted data. There is no indication that any patient or employee information has been compromised.

No information on the type of ransomware used in the attack has been released nor whether the decision has been made to pay the ransom to regain access to data.

The post Ransomware Attack on Finger Lakes Health Cripples Computers appeared first on HIPAA Journal.

Beverly Hills, CA-based RoxSan Pharmacy has notified 1,049 patients that some of their protected health information has been disclosed to a business associate via unencrypted email.

The notification letters were mailed to affected individuals last month, although the incident occurred on January 20, 2015. In a recent press release, RoxSan explained that affected individuals are being notified in “as timely a manner as possible”. The delay in issuing notifications was due to “the protected nature of the forensic investigation”. It is unclear when RoxSan Pharmacy became aware of the error.

The protected health information was included in a data file that was sent to a single individual – A business associate of the pharmacy – who worked in the legal field. That individual had signed a business associate agreement with the pharmacy and was aware of the responsibilities of HIPAA with respect to patients’ PHI. However, the PHI was exposed as the data file was sent via unencrypted email.

The data file only contained a limited amount of protected health information and did not include patient names, personal identification information, Social Security numbers, or financial information.

The information related to patients who had prescriptions filled between April 2015 and August 2015 and was limited to prescription information, drug information, insurance information, physicians’ names, and patient identification numbers.

RoxSan has not received any reports that suggest the information has been intercepted and misused. Patients have been advised of the steps they can take to protect their identities and monitor for fraudulent use of their information as a precaution.

The pharmacy has already taken steps to improve its operational protections to prevent any further breaches of this nature from occurring.

The post RoxSan Pharmacy Notifies 1,049 Patients About 2015 Email Breach appeared first on HIPAA Journal.

Primary Health Care Inc., a non-profit network of community health centers in Des Moines, Marshalltown and Ames, IA, has discovered malicious actors have gained access to the email accounts of four employees and have potentially viewed or obtained patients’ protected health information.

Primary Health Care issued a press release and uploaded a substitute breach notice to its website on March 16, 2018 explaining the breach occurred on February 28, 2017. The breach was detected the following day on March 1, 2017. Primary Health Care is in the process of notifying affected patients and will be reporting the incident to the Department of Health and Human Services’ Office for Civil Rights. No explanation is provided as to why the breach took a year to report, although the timing of the breach notice suggests the year stated in the breach notice may be a typo and that the breach occurred this year.

Primary Health Care responded quickly to the breach and terminated access to the compromised email accounts and hired a third-party computer forensics expert to conduct an investigation into the attack. The investigation revealed access to four email accounts and their associated Google Drives was gained by the attacker(s), although it was not possible to tell whether any emails were opened and if any protected health information was viewed.

An analysis of the email accounts revealed they contained information such as patients’ names along with driver’s license numbers, Social Security numbers, diagnoses, treatment information, medical histories, health insurance/payor information, facilities and providers visited, financial account numbers, credit/debit card numbers, dates of service, and in some cases, Medicaid numbers.

No evidence has been found to suggest any information has been misused, although out of an abundance of caution, affected individuals have been offered 12 months of identity theft protection services through AllClear without charge.

Primary Health Care is in the process of implementing additional security measures to enhance the privacy and security of its information systems to prevent further breaches of this nature.

The post Multiple Email Accounts Compromised at Primary Health Care appeared first on HIPAA Journal.