West Virginia-based Coplin Health Systems has informed 43,000 patients that their PHI has potentially been exposed as a result of the theft of an unencrypted laptop computer from the vehicle of an employee.

Coplin Health was alerted to the theft on November 2, 2017. The theft was immediately reported to law enforcement and an investigation was launched, although at the time of issuing notifications, the laptop computer has not been recovered.

While it is possible that protected health information of patients was stored on the laptop, Coplin Health does not believe that was the case, although the possibility of data exposure cannot be ruled out with 100% certainty.

Coplin Health notes that the laptop had various security protections in place to ensure the privacy of patients in the event of the laptop being stolen. While the laptop could potentially be used to gain access to patient data, a password would have been required and it is not suspected that the thief had “the sophisticated knowledge and resources necessary to bypass the laptop’s security mechanisms.”

Further, Coplin Health’s IT department took rapid action to limit the potential for harm. The employee’s login credentials were changed to prevent the laptop from being used to access Coplin Health’s systems, and no attempts have been made to access its systems using the laptop since the device was stolen.

The chance of patient data being stored locally on the device is believed to be low, although if that was the case, the device would have contained files that included patient names, addresses, Social Security numbers, birth dates, financial information and health information. Out of an abundance of caution, 43,000 patients have been notified of the potential exposure of their PHI.

The incident has prompted Coplin Health to conduct a review of its security protections and actions have been taken to prevent a recurrence. Coplin Health will also increase monitoring to make sure policies and procedures are being following by its employees and any future breach of policies will result in disciplinary action being taken against the employees concerned.

The Health Insurance Portability and Accountability Act (HIPAA) requires covered entities to consider the use of encryption, although the use of encryption is not mandatory. The decision about the use of encryption should be based on a risk assessment. If encryption is not implemented, alternative, equivalent measures must be used in its place. Coplin Health has not said whether it plans to augment its security protections with encryption in the future.

The post 43,000 Patients of Coplin Health Systems Potentially Impacted by Laptop Theft appeared first on HIPAA Journal.

DJO Global, a provider of medical technologies to help patients maintain and regain natural motion, has discovered that some patients’ information has been exposed, and potentially disclosed, to unauthorized individuals.

Individuals who had received a DJO Global device in the emergency room, Urgent Care Site, or the Same Day Surgery Center of the Siena, San Martin or De Lima campuses of St. Rose Dominican Hospital in Las Vegas, NV between July 17 and October 16, 2017 have potentially been affected.

Those individuals are likely to have signed a DJO Global Patient Product Agreement confirming they had received one of the company’s devices. Those consent forms should have been sent to DJO Global; hhowever, a batch of consent forms was not received.

A DJO employee collected the forms from St. Rose Dominican Hospital and should have taken them to DHL to be delivered to DJO Global; however, the forms were lost in transit. They are believed to have been lost between collection from the hospital and delivery to DHL.

The forms contained the following information: Name, phone number, address, birth date, physician name and location, product order date, product information, date of injury, diagnosis code(s), health plan identification number, and health plan information. Some patients whose health plan uses Social Security number as patient identifiers would also have had their Social Security number exposed.

DJO Global has not received any reports to suggest patients’ exposed information has been misused, although since it is possible that the forms have been obtained by a third party, data misuse is a possibility. To ensure that patients are protected, all have been offered complimentary credit monitoring services for 12 months. Patients have also been advised to place a fraud alert on their credit files, to obtain copies of their credit reports, and to check their explanation of Benefits statements carefully for any sign of fraudulent activity.

DJO Global has responded to the incident by changing polices and procedures for mailing and has implemented new quality controls to prevent similar incidents from occurring in the future. Its vendor has also received further training on the importance of securing and protecting patient health information.

Patients impacted by the incident have now been notified by mail, and the Department of Justice and Department of Health and Human Services’ Office for Civil Rights have been notified of the incident.

The post St. Rose Dominican Hospital Patients Impacted by DJO Global PHI Breach appeared first on HIPAA Journal.

Framingham, MA-based Charles River Medical Associates has discovered the danger of failing to use encryption to protect data stored on portable hard drives.

In late November, the practice discovered one of its portable hard drives was missing. The device contained x-ray images, names, patient ID numbers, and birth dates. Every patient who had visited the Framingham radiology lab for a bone density scan since 2010 had their x-ray images exposed – almost 9,400 individuals.

The hard drive was used by the practice as a backup device and updated the stored data each month with bone density scans from the past four weeks. The last time the device was used was for the October data backup. In late November, when the monthly backup was scheduled to be made, the portable drive could not be found.

A full search of the premises was conducted, which took several weeks, but the device could not be located. All staff members were questioned about the whereabouts of the drive, but no one had seen the device in the past four weeks.

Charles River Medical Associates has now declared the device lost and the search has been called off. Brian Parillo, executive director of Charles River Medical Associates said, “It’s hard to speculate on what could have happened to it.”

The loss of any device containing unencrypted protected health information is a reportable incident under HIPAA Rules and patients must be notified of the potential breach of their information. In compliance with HIPAA Rules, the incident has now been reported to the Department of Health and Human Services’ Office for Civil Rights (OCR) and patients have been informed of the breach by mail.

While the drive is believed to have been lost rather than stolen, it is possible that the device has been found and the information stored on the drive viewed by unauthorized individuals. Patients have therefore been advised to take steps to guard against any negative impact from the incident, including obtaining credit reports and checking their credit accounts for any sign of fraudulent activity.

However, since no Social Security numbers, financial information, or health insurance details were stored on the device, the potential for identity theft and fraud is low.

As a result of the incident, the decision has been taken to stop using unencrypted portable drives to store backups. A full security review has also been conducted to identify other potential vulnerabilities to the confidentiality, integrity, and availability of PHI, a review of hardware has been conducted, and staff have been retrained on privacy workflows.

The breach report submitted to OCR indicates 9,387 patients have been impacted by the incident.

The post Lack of Encryption on Hard Drive Results in the Exposure of 9387 Patients’ PHI appeared first on HIPAA Journal.

Oklahoma State University Center for Health Sciences (OSUCHS) has discovered an unauthorized individual has gained access to parts of its computer network and potentially accessed files containing billing information of Medicaid patients.

The security breach was discovered on November 7, 2017 with access to the network terminated the following day. Third party computer forensics experts were called upon to conduct a comprehensive investigation to determine which parts of the network had been accessed, and whether patient health information had been accessed or stolen.

The investigation confirmed that patient health information could potentially have been viewed, although it was not possible to determine whether patient information had been accessed or stolen. OSUCHS reports that it has not received conclusive information to suggest any patient information has been misused.

Out of an abundance of caution, all individuals potentially impacted by the incident have been notified of the breach by mail and advised that they should be alert to the possibility that their personal information could potentially be misused.

OSUCHS says medical records were not compromised and the breach was limited to names, healthcare provider names, Medicaid numbers, dates of service, and a limited amount of treatment information. Only one Social Security number was present on the compromised server.

The breach has prompted OSUCHS to conduct a review of security protections and additional measures have now been implanted to better protect patient information in the future.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal so it is currently unclear exactly how many individuals have been impacted.

The post Oklahoma State University Center for Health Sciences Informs Patients of PHI Breach appeared first on HIPAA Journal.

The Agency for Health Care Administration in Florida has discovered an unauthorized individual has gained access to a single email account as a result of an employee falling for a phishing scam.

The employee received and responded to the malicious phishing email on November 15, 2017 and disclosed login credentials that allowed the attacker to remotely access his/her email account and, potentially, the protected health information of as many as 30,000 Medicaid enrollees.

The agency discovered the security breach on November 20 and performed a password reset to prevent further access. The incident was also reported to the agency’s inspector general, who launched an investigation into the attack. Preliminary findings of that investigation were released late last week.

According to an agency press release issued on Friday, the unauthorized individual may have partially or fully accessed information such as names, Medicaid ID numbers, addresses, dates of birth, diagnoses, medical conditions, and Social Security numbers. Approximately 6% of individuals impacted by the incident had either their Medicaid ID or Social Security number exposed.

While data access was possible, Florida’s Agency for Health Care Administration has not uncovered any evidence to suggest the compromised protected health information has been misused. Since sensitive information has potentially been viewed and stolen, individuals impacted by the incident have been told to be vigilant and check their accounts for signs of fraudulent activity. All individuals impacted by the breach have been offered complimentary credit monitoring services for 12 months.

Prior to the phishing attack, the Florida Agency for Health Care Administration had implemented an ongoing staff training program, although the incident has prompted a review of that program and staff have now been reeducated on proper security protocols and the dangers of phishing. The agency is also considering additional security controls to reduce the risk from phishing in the future.

The post Phishing Attack on Florida Agency for Health Care Administration Impacts 30,000 Medicaid Recipients appeared first on HIPAA Journal.

Compassionate Care Hospice Las Vegas (CCHLV) has discovered an unauthorized individual gained access to its network and server and potentially viewed 1,128 patients’ protected health information.

On October 28, 2017, CCHLV discovered its network had been accessed by an unauthorized individual. Upon discovery of the breach, CCHLV hired third-party forensics experts to conduct a thorough investigation to determine the nature of the breach and to identify all patients who were potentially affected.

While the investigation confirmed access to data was possible, no evidence was uncovered to suggest any sensitive information was viewed or stolen by the attacker. However, it was not possible to rule out data access and theft with 100% certainty.

The types of information stored on the parts of the network that could have been accessed included names, dates of birth, addresses, Medicare numbers, medical treatment information, health insurance information, and archived electronic health records. Financial information was not stored on the part of the network compromised in the attack and remained secure at all times.

Once access to the network and server had been blocked, CCHLV conducted a comprehensive risk analysis to identify potential vulnerabilities to the confidentiality, integrity, and availability of PHI and has reviewed and revised network security policies accordingly. To ensure that any future cyberattacks are detected and mitigated rapidly, CCHLV has now implemented intrusion detection and monitoring systems.

CCHLV notified all affected individuals by mail on December 14, 2017 and reported the incident to the Department of Health and Human Services’ Office for Civil Rights. Upon discovery of the attack, law enforcement was notified and CCHLV is continuing to assist with the investigation.

Out of an abundance of caution, all patients impacted by the breach have been offered complimentary credit monitoring and identity theft restoration services for 12 months through Kroll.

The post Compassion Care Hospice Hack Impacts 1,128 Patients appeared first on HIPAA Journal.

Kaiser Permanente has experienced two security incidents which have recently been reported to the Department of Health and Human Services’ Office for Civil Rights. In total, more than 5,000 individuals have been impacted by the breaches.

Both breaches affect members of the Kaiser Foundation Group Health Plan. The most serious incident, in terms of the number of individuals impacted, was an email-related breach affecting 4,389 health plan members in the San Bernardino County area of Southern California.

An unauthorized individual was discovered to have gained access to the email account of a Southern California Permanente physician, which contained a limited amount of protected health information.

Kaiser Permanente conducted an extensive investigation to determine the nature and full extent of the breach. While the email account was accessed, Kaiser Permanente believes the risk to plan members is low due to the nature of data contained in the email account.

The email account did not contain highly sensitive information such as bank account details, credit card numbers, insurance information, or Social Security numbers. The breach was limited to plan members’ names, ages, dates of service, medical record numbers, phone numbers, limited medical information, and flu shot data.

Affected members have been informed of the breach by mail and Kaiser Permanente is exploring additional technology that can be implemented to prevent similar breaches from occurring in the future.

One week later, Kaiser Permanente reported a second breach, this time involving the PHI of 638 plan members. The second breach occurred between October 9 and October 13, 2017 and was a mis-mailing incident. Letters containing a limited amount of protected health information were sent to incorrect plan members in the West Los Angeles area.

No Social Security numbers, medical record numbers, financial information, or other highly sensitive information was involved. Affected members have been notified and mailing workflow processes have been reviewed and updated to prevent a recurrence.

The post Kaiser Permanente Reports Two Security Incidents Impacting 5,000 Members appeared first on HIPAA Journal.