Westchester Medical Center Health Network (WMCHealth) has experienced a cyberattack that affected its information technology systems. The attack was detected last week, and at 10 p.m. on Friday, October 20, 2023, the decision was taken to shut down all connected IT systems. The downtime was expected to last for 24 hours, and systems were brought back online on a rolling basis over the weekend. All systems were restored by Monday, October 24.

Without access to essential IT systems, the decision was taken to divert ambulances at HealthAlliance of the Hudson Valley facilities, including HealthAlliance Hospital in Kingston, Margaretville Hospital in Margaretville, and the skilled nursing facility, Mountainside Residential Care Center in Margaretville. The diversion ended on Saturday night and the hospitals resumed patient admissions, although stroke patients are still being taken to alternative facilities.

WMCHealth said the New York State Department of Health and Ulster and Delaware County officials were notified about the attack and it has been working with law enforcement, including the FBI, and has engaged a third-party cybersecurity firm to assist with the investigation. The first priority was ensuring patient safety, which is why ambulances were diverted. The hospitals remained open throughout and continued to accept walk-in patients, who were assessed, treated, and released, or transferred to alternative WMCHealth facilities.

The investigation of the attack is ongoing, and it has not yet been determined if any patient data was compromised. Should that turn out to be the case, notifications will be issued as soon as possible.

PHI Compromised in Cyberattack on Fellowship Village

Fellowship Village, a retirement community in Bernards Township, NJ, has recently announced a security breach that was detected on or around August 9, 2023. The forensic investigation confirmed that there had been unauthorized access to its network between July 27, 2023, and August 9, 2023, during which time files containing sensitive information may have been accessed and exfiltrated.

The review of the affected files is ongoing, but it has been confirmed that protected health information may have been compromised. The information involved includes a combination of names, addresses, Social Security numbers, patient identification numbers, medical record numbers, medical information, treatment information, diagnosis information, health insurance information, driver’s license/state identification numbers, financial account information, and dates of birth.

Policies and procedures are being reviewed and security will be enhanced to prevent further data breaches. To meet breach reporting requirements, the HHS’ Office for Civil Rights has been notified and told at least 501 individuals were affected. The total will be updated when the full scale of the breach is determined.

Hackers Gained Access to PHI of BHI Energy Health Plan Members

BHI Energy, a Weymouth, MA-based provider of project management and staffing support to the nuclear, fossil, wind, hydro, and government energy markets, has discovered an unauthorized third party gained access to certain systems within its network. The breach was detected on or around June 29, 2023, and the subsequent investigation confirmed on September 1, 2023, that business records had been accessed, some of which contained individuals’ personally identifiable information (PII).

In total, the PII of 91,269 individuals was potentially compromised, including the 4,049 members of its health plan. The compromised data included first, middle, and last name, address, date of birth, and Social Security number, and potentially health information. Affected individuals have been offered complimentary credit monitoring and identity theft protection services. Additional security measures have been implemented to improve data security and prevent similar breaches in the future.

MOVEit Transfer Hacking Victims

NASCO

NASCO, an Atlanta, GA-based provider of benefits administration services to health plans, has confirmed that it was affected by the mass exploitation of a zero-day vulnerability in Progress Software’s MOVEit Transfer file transfer solution, which was used to transfer files to its health plan clients.  The vulnerability was exploited on May 30, 2023, the day before Progress Software released the patch to fix the flaw. NASCO said it learned that it had been affected on July 12, 2023. While no misuse of the stolen data has been detected, notification letters have been issued and the 2,956 affected individuals have been offered complimentary credit monitoring and identity theft protection services for up to 24 months. The breached information included names and Social Security numbers.

Meadville Medical Center

Meadville Medical Center in Pennsylvania has confirmed that it was affected by the MOVEit Transfer hacks. The file transfer solution was used by Westat Inc., which provided data collection and management services as part of the National Hospital Care Survey (NHCS). The breach was detected on May 30, 2023, and involved the protected health information of approximately 1,300 patients. Westat has offered the affected individuals 12/24 months of complimentary credit monitoring services.

Cape Fear Valley Health

Cape Fear Valley Health in Fayetteville, NC, was also affected by the MOVEit Transfer hack at Westat. Files were copied that included the protected health information of 1,943 patients, most of whom had been treated between February 2023 and May 2023. The stolen data included names, addresses, dates of birth, and diagnoses.  Affected individuals have been offered 12/24 months of complimentary credit monitoring services.

The post Ambulances Diverted After Westchester Medical Center Health Network Cyberattack appeared first on HIPAA Journal.

Fairfax Oral and Maxillofacial Surgery in Virginia has confirmed that the protected health information of up to 235,931 individuals was potentially compromised in a ransomware attack in May 2023. The security incident was detected on May 16, 2023, when files were encrypted on its systems. The forensic investigation determined that an unauthorized third party had access to its network between May 15 and May 16, 2023.

According to the breach notification submitted to the Maine Attorney General, the investigation did not find any evidence of data theft, although the possibility that files were stolen could not be ruled out. The review of the files on the affected parts of the network determined they contained information such as names, driver’s license numbers, health insurance information, medical history information, and for some individuals, Social Security numbers. Fairfax Oral and Maxillofacial Surgery said it has taken steps to reduce the risk of this type of incident occurring in the future, including enhancing its technical security measures. A complimentary one-year membership to the Experian IdentityWorksSM Credit 3B service has been offered to the affected individuals.

Henwood Family Dentistry Says 7,300 Patients Affected by Cyberattack

Borgfeld Dental Center PLLC, doing business as Henwood Family Dentistry in San Antonio, TX, has recently announced that the protected health information of 7,300 patients was potentially accessed by unauthorized individuals in August. The security breach was detected on August 17, 2023, and the forensic investigation determined that access was gained to a desktop computer via a remote-access tool, and the credentials for a user account were used to access its network.

Henwood Family Dentistry said it is aware that one of its patients has been contacted directly by the attacker, and has advised patients not to engage with the attacker if they are contacted. The Federal Bureau of Investigation has been notified about the attack and is investigating. The types of data exposed varied from individual to individual and may have included one or more of the following: full name, date of birth, address, telephone number, email address, Social Security number, driver’s license number, government-issued identification number, health insurance information, and/or information regarding dental/orthodontic care.

Henwood Family Dentistry said it took several mitigation steps, including blocking the unauthorized access, changing passwords, replacing the hard drives of the affected computers, and has reviewed its security strategies and systems to identify possible enhancements. Affected individuals have been offered complimentary credit monitoring and identity theft protection services.

Piedmont Healthcare Affected by Cyberattack on Administrative Services Provider

Piedmont Healthcare, Inc., a 23-hospital health system serving the southeast United States, was affected by a cyberattack on its claims processing and administrative services provider, Pharm-Pacc. The attack was detected on March 24, 2023, and on or around March 15, 2023, it was confirmed that protected health information stored on Pharm-Pacc’s systems was accessed. Piedmont Healthcare was notified it was affected on July 14, 2023. Pharm-Pacc has offered the affected individuals 12 months of credit monitoring, fraud consultation, and identity theft restoration services. 895 Piedmont patients are known to have been affected.

Surround Care Impacted by Navvis & Company Cyberattack

Surround Care, LLC, a wholly owned subsidiary of Navvis & Company, has confirmed that the protected health information of 917 individuals has been exposed in a cyberattack. The attack was detected on July 25, 2023, and the forensic investigation confirmed that an unauthorized third party had access to its network between July 12, 2023, and July 25, 2023. The exposed information included names, dates of birth, Medicaid/Medicare ID numbers, health plan information, medical treatment information, medical record numbers, patient account numbers, case identification numbers, provider/ doctor information, health record information, and for some individuals, Social Security numbers. Surround Care said no evidence of any identity theft or fraud has been identified in connection with this incident.

MOVEit Hacking Victims

Many HIPAA-covered entities and business associates have reported being affected by the mass exploitation of a zero-day vulnerability in Progress Software’s MOVEit file transfer solution in May 2023. IBM and San Diego Pace have now confirmed that they were affected.

IBM

IBM has started notifying 630,755 individuals that some of their protected health information was stolen by the Clop group when it exploited the MOVEit vulnerability in late May. The attack on IBM also affected the Missouri Department of Social Services (DSS), which reported that names, department client numbers, dates of birth, benefit eligibility status or coverage, and medical claims information, were compromised in the attack. The Colorado Department of Health Care Policy & Financing (HCPF) was also affected and said the protected health information of 4,091,794 individuals was stolen. In total, the data of more than 10 million individuals is believed to have been stolen in the attack on IBM.

San Diego PACE

San Diego PACE, a specialized health plan for individuals over 55 years of age, has confirmed that the information of some of its members has been stolen in a cyberattack on one of its vendors. Cognisight is a business associate that provides healthcare management services to San Diago PACE and uses Progress Software’s MOVEit solution for file transfers. The MOVEit solution was compromised in late May and on June 5, 2023, it was confirmed that some plan member data had been stolen. The delay in issuing notifications was due to the time taken to review the affected files and obtain up-to-date contact information. Affected individuals have been offered complimentary credit monitoring services.

The post 236,000 Individuals Affected by Fairfax Oral and Maxillofacial Surgery Ransomware Attack appeared first on HIPAA Journal.

The Texas Medical Liability Trust (TMLT) has reported a data breach to the Maine Attorney General on behalf of itself and its affiliates, Texas Medical Insurance Company, Physicians Insurance Company, and Lone Star Alliance, Inc., a Risk Retention Group that has affected 59,901 individuals.

Suspicious activity was detected within its IT environment on October 12, 2022. Steps were taken to secure its systems and third-party forensics specialists were engaged to investigate. They determined that an unauthorized actor had access to its environment between October 2, 2022, and October 13, 2022, and during that time, files containing protected health information may have been accessed that included names, Social Security numbers, EIN/Tax Identification numbers, state identification/driver’s license information, and financial account information. It took until August 18, 2023, to complete the review of the affected files.

Complimentary credit monitoring services have been offered to the affected individuals and a review of policies, procedures, and processes related to the storage and access of sensitive information has been conducted.

Email Account Breach Affects Patients of Bloom Health Centers

On July 5, 2023, Bloom Health Centers in Timonium, MD, identified suspicious activity in its Microsoft 365 email environment. Steps were immediately taken to prevent further unauthorized access and an investigation was launched to identify the activity. Assisted by a third-party cybersecurity firm, Bloom Health Centers determined that the email account of one of its clinicians was accessed without authorization on or around June 23, 2023.

The review of the account was completed on August 7, 2023, and confirmed the account contained the protected health information of 1,545 patients including names, addresses, email addresses, telephone numbers, dates of birth, and medical information such as medications and diagnoses. That information may have been accessed or acquired during the incident; however, no instances of misuse of patient data have been identified.

The affected individuals have now been notified by mail and credit monitoring and identity theft protection services have been offered. Email security measures have been enhanced and further training on data protection best practices have been provided to all members of the workforce.

Prime Therapeutics/Magellan Rx Management Report Email Account Breach

Prime Therapeutics, a Minnesota-based pharmacy benefit management company serving health plans, employers, and government programs, and the next-generation pharmacy organization, Magellan Rx Management, a Prime Therapeutics company, have experienced a data breach involving the protected health information of 6,050 individuals.

The compromised data was stored in an employee’s mobile email account, which was discovered on July 11, 2023, to have been accessed by an unauthorized individual. The compromised credentials were disabled, the unauthorized individual’s IP address was blacklisted, and a review was conducted to determine what information had been exposed. While evidence of unauthorized data access was not found, the attacker may have been able to view names, addresses, dates of birth, member ID numbers, and medication(s).

Prime Therapeutics said it will continue to review internal procedures for potential improvements to strengthen account security and is evaluating additional safeguards to help prevent similar incidents from reoccurring in the future.

Carthage Area Hospital and Claxton Hepburn Medical Center Dealing with Cyberattack

Carthage Area Hospital and Claxton Hepburn Medical Center in Northern New York experienced a cyberattack on August 31, 2023. The hospitals put their emergency rooms on diversion and appointments were cancelled as a precaution due to IT systems being taken offline.

The FBI, New York State Department of Health, and the Department of Homeland Security were notified about the attack and the government is aware of the threat actor behind the attack but has not disclosed which group was responsible. The incident has been contained but the investigation is ongoing. At this stage of the investigation, it appears that patient data has not been compromised.

The post 60,000 Individuals Affected by Texas Medical Liability Trust Data Breach appeared first on HIPAA Journal.

Lifeline Systems Company, a Marlborough, MA-based provider of patient alarm systems has recently notified 74,849 individuals about a data breach that occurred more than a year ago. According to the notification letters, unusual network activity was detected on August 6, 2022. Incident response protocols were immediately initiated, and a third-party computer forensic investigation was launched to investigate the nature of the incident.

The investigation confirmed that an unauthorized individual had access to its systems from July 27, 2022, to August 6, 2022, and accessed certain documents on its systems during that period. On August 18, 2022, Lifeline determined the documents included information for subscribers, employees, and individuals eligible to receive Lifeline services. The exposed information included names, driver’s license numbers, and Social Security numbers.

Due to the length of time taken to perform the document review, notification letters could not be sent until September 7, 2023. Complimentary credit monitoring services have been offered to individuals who had their Social Security number or driver’s license number exposed. Lifeline said it has enhanced its network monitoring capabilities and will continue to conduct audits of its systems to look for unauthorized activity.

Milan Eye Center Reports Breach at EHR Vendor

Milan Eye Center, an Atlanta, GA-based network of eye surgery centers, has started notifying 67,336 patients that some of their protected health information was compromised in an incident at its third-party vendor, iMedicWare Inc.  Milan Eye Center said it was informed about a data compromise incident on December 9, 202, and launched an investigation which concluded on July 24, 2023, that an unauthorized individual was able to access at least some historical patient archives maintained by iMedicWare between May 18, 2020, and July 23, 2020.

The records included information such as names, birth dates, telephone numbers, insurance coverage information, Social Security numbers, service locations, dates of service, and health statuses. It was not possible to determine exactly which patient records were accessed, so notification letters were sent to all individuals who received services on or before July 23, 2020. Complimentary credit monitoring services have been offered to the affected individuals.

Milan Eye Center confirmed it no longer uses iMedicWare as its electronic health record vendor and said additional technical safeguards and policies have been implemented to enhance information system security.

NOW Health Group Suffers Phishing Attack

Bloomingdale, IL-based NOW Health Group, Inc. has recently determined that the protected health information of 4,661 individuals was compromised in a phishing attack. The attack was detected on or around March 17, 2023, when suspicious activity was identified in its email environment. The forensic investigation determined that unauthorized individuals gained access to certain employee email accounts between March 17 and March 20. A review of the emails and documents in the accounts was completed on July 6, 2023. The information potentially compromised included names and Social Security numbers.

Additional safeguards have been implemented to improve email security and further training has been provided to employees to help them identify phishing attempts. Complimentary credit monitoring services have been offered to the affected individuals.

Mountain View Family Practice Reports June 2023 Cyberattack

Mountain View Family Practice in Baldwinville, MA, has alerted 5,139 about a June 11, 2023, cyberattack on its systems. The forensic investigation determined that an unauthorized individual had access to its systems between June 10 and June 11, 2023, and viewed and potentially obtained certain data stored on its systems, including names and Social Security numbers. Notifications were sent to the affected individuals on August 31, 2023, and credit monitoring and identity theft protection services have been offered.

The post Lifeline Systems Company Notifies Patients About August 2022 Cyberattack appeared first on HIPAA Journal.