Midland Memorial Hospital in Midland, TX, and Washington Health System Greene in Waynesburg, PA, have announced they have discovered patients’ protected health information has been exposed.

Washington Health System Greene Discovers Hard Drive Missing

Washington Health System Greene is alerting 4,145 patients that some of their protected health information has been exposed after a hard drive was discovered to be missing.

A portable hard drive used with a bone densitometry machine in the Radiology department was discovered to be missing on October 11, 2017. While it is possible that the hard drive may have been misplaced, a search of the hospital did not uncover the device, and the missing device has been reported to the Pennsylvania State Police Department as a potential theft.

The device contained information on patients who visited the hospital for bone density scans between 2007 and October 11, 2017. The information stored on the device was limited to names, height, weight, race, and gender, while some patients also had details of health issues, the name of their prescribing physician, and medical record numbers stored on the device. No financial information, Social Security numbers, insurance details, or other highly sensitive information was exposed.

As required by HIPAA, patients have been notified of the breach. Due to the limited nature of data exposed, even if the device has been stolen, Washington Health Greene does not believe patients are at risk of identity theft or fraud.

Midland Memorial Hospital Discovers Email Account Compromise

Midland Memorial Hospital has experienced a breach of a limited amount of patients’ protected health information. More than 1,000 patients are understood to have been affected.

Midland Memorial Hospital discovered an unauthorized individual gained access to the email account of an employee at the hospital, in what appears to be an attempted Business Email Compromise (BEC) attack. The aim of the attacker appeared to be to fool employees into making bank account transfers to an inappropriate bank account.

The breach was discovered on October 13, 2017, with access to the email account believed to have been gained on or around October 10.  Upon discovery of the security breach, access the email account was terminated and a full investigation was conducted. The email account was determined to contain some protected health information including first and last names, medical record numbers, account numbers, and information relating to radiology procedures that had been performed at the hospital between August and September 2017. No financial information, driver’s license numbers, or Social Security numbers were exposed, and no evidence has been uncovered to suggest any patient information has been used inappropriately.

Midland Memorial Hospital has taken steps to prevent further incidents of this nature from occurring, including revising policies and procedures and retraining staff.

The post Texas and Pennsylvania Data Breaches Exposed More than 5,000 Patients’ PHI appeared first on HIPAA Journal.

Over the past two months there have been several data breaches reported by HIPAA-covered entities involving the loss or theft of physical records. In November, 7 breaches involving paper records were reported to the HHS’ Office for Civil Rights, and a further 5 incidents were reported the previous month.

Now another incident has been reported in Illinois. Franciscan Physician Network of Illinois and Specialty Physicians of Illinois LLC have discovered payment records that were kept in a storage facility are missing. The storage facility in Chicago Heights was shared by both physician groups.

The loss/theft of the paperwork is one of the largest breaches of the past few months, potentially impacting as many as 22,000 patients. The payment records were from 2015-2017 and 2010.

The boxes of files were confirmed as missing on November 21, 2017, with notifications issued on December 13, 2017. The loss of files was discovered following a routine records request, but the records could not be located. An inventory of the storage facility was conducted, and 40 boxes of files were determined to be missing and potentially stolen.

The records only contained a limited amount of patient information related to payments received, and included names and addresses, payment methods, payment amounts, office location, and the last four digits of credit card numbers. For a limited number of patients who paid their bill by check, their routing number, bank account number and Social Security number were also present in the files.

Some of the records from 2010 may also have included insurance ID numbers, facility-assigned account numbers, dates of birth, type of visit, diagnoses, provider names and addresses, dates of service, descriptions of services provided, and procedure codes.

While it is a possibility that the files have been stolen, foul play is not suspected. Out of an abundance of caution, individuals impacted by the incident have been offered two years of identity theft protection services without charge.

The post Illinois Physicians Network Discovers Paper Records Missing from Storage Facility appeared first on HIPAA Journal.

A computer used by UNC Dermatology & Skin Cancer Center in Chapel Hill, NC, has been stolen, exposing the protected health information of approximately 24,000 patients.

The computer was stolen by thieves during a burglary on October 8, 2017. UNC Health Care said a database on the stolen computer contained the protected health information of patients who had previously visited the Burlington Dermatology Center at 1522 Vaughn Road. UNC Healthcare took over the practice in September 2015, and details of patients who had visited the center for treatment prior to September 2015 were stored in the password-protected database.

Since the database requires a password to gain access to patient information, it is possible that no PHI has been disclosed. However, since passwords can be guessed, and the database was not encrypted, patients are being notified of the potential privacy breach to meet HIPAA and N.C. Identity Theft Act requirements.

The database contained information such as names, addresses, phone numbers, dates of birth, Social Security numbers, and the employment status of patients and the names of employers at the time of their visit. While it is possible that diagnosis codes were also present in the database, UNC Health Care does not believe details of diagnoses, treatments, and prescriptions have been exposed.

The burglary has been reported to law enforcement and an investigation is ongoing, but the stolen computer has not been recovered to date.

As a precaution against identity theft and fraud, all patients impacted by the breach have been offered credit monitoring services for 12 months without charge.

CCRM Minneapolis Alerts Patients of Ransomware Attack

CCRM Minneapolis, P.C., has experienced a ransomware attack that has potentially allowed the attackers to gain access to the protected health information of 3,280 patients.

The attack occurred on or around October 3, 2017. While data access and PHI theft are not suspected, and no evidence was uncovered to suggest this was anything other than an extortion attempt involving the encryption of data, CCRM Minneapolis reports that data stored on the compromised server may have been viewed.

Data potentially exposed includes names, phone numbers, addresses, dates of birth, email addresses, driver’s license numbers, Social Security numbers, medical records, and insurance identification numbers.

The post UNC Health Care Breach Potentially Impacts 24,000 Patients appeared first on HIPAA Journal.

The email accounts of two employees of Chicago’s Sinai Health System have been compromised in a recent phishing attack.

Sinai Health System reports that the phishing attack occurred on October 2, and that it was quickly identified and mitigated. Access to the compromised accounts was possible only for a matter of hours. Cybersecurity experts were called in to assist with the investigation, and while the possibility of PHI access cannot be ruled out, the risk faced by patients is believed to be low.

No evidence has been uncovered to suggest any financial information was accessed, although an analysis of the email accounts revealed a range of protected health information of 11,350 patients was contained in the email accounts and could potentially have been viewed.

As a precaution against identity theft and fraud, patients impacted by the breach have been offered identity theft protection and credit monitoring services free of charge for 12 months.

Mitigating the Ever-present Threat from Phishing

Phishing is the biggest cybersecurity threat faced by organizations, with the healthcare industry often targeted by cybercriminals.

A recent study from IronScales shows that between 90% and 95% of successful breaches are the result of phishing. Research conducted by anti-phishing vendor PhishMe similarly suggest more than 90% of data breaches start with a phishing email.

Even with multi-layered phishing defenses, some emails will make it past perimeter defenses and will be delivered to end users’ inboxes. It is therefore important to provide security awareness training to employees. Not only will training help to improve the phishing email identification skills of employees and will help to prevent costly data breaches, it is also a requirement of HIPAA.

In its July Cybersecurity Newsletter, OCR reminded HIPAA-covered entities of the importance of providing regular training to employees. The newsletter came after a spate of phishing incidents reported by healthcare providers. The past couple of weeks have several further data breaches caused by phishing, underscoring the need for continuous training of healthcare employees.

While HIPAA does not stipulate how often security awareness training should be provided, OCR suggests that many healthcare organizations are providing biannual training sessions, with regular newsletters issued on specific threats and to maintain awareness of the risks from phishing. Using a combination of computer-based training, classroom sessions, newsletters, posters, and phishing simulation exercises, covered entities and their business associates can improve security awareness of the workforce.  Alongside spam filters and other anti-phishing technologies, organizations can reduce the risk from phishing to a low and acceptable level.

A recent State of the Phish Report from Wombat Security Technologies suggests that while employees are getting better at identifying phishing emails as a result of security awareness training, many organizations are failing to implement effective employee security awareness training programs.

24% of respondents of a recent survey failed to identify phishing emails – An improvement from the 28% of failures last year, but still a major cause for concern. The State of the Phish report also highlighted the need for continuous security awareness training. Last year when the survey was conducted, respondents scored particularly highly on questions relating to safe Internet access, yet there was a sharp fall in risk awareness in this category a year later. If training is not regularly reinforced, basic security practices can be all too easily forgotten.

The post 11,350 Sinai Health System Patients Potentially Impacted by Phishing Attack appeared first on HIPAA Journal.