The St. Louis, MO-based not-for-profit health system SSM Health has discovered a former employee has been accessing the health records of patients without any legitimate work reason for doing so for 8 months.

The former employee worked in SSM Health’s customer service call center, and as such, did not have access to financial information, only demographic, health, and clinical information.

The improper access was detected by SSM health on October 30, prompting a thorough investigation to determine the records that had been accessed and which patients were potentially at risk. The investigation revealed the records of patients in multiple states were accessed by the employee between February 13 and October 20, 2017.

The employee was primarily interested in the records of patients of a primary care physician in the St. Louis area, specifically patients who had been prescribed a controlled substance. While that subset of patients was relatively small, it was not possible to determine the full scope of the privacy breach, so SSM Health took the decision to notify all patients whose records had been accessed by the former employee. In many cases, that access will have been for legitimate work purposes.

In total, 29,000 patients have been notified of the incident and warned that their protected health information may have been improperly accessed and could potentially have been misused. Those patients have been offered identity theft protection services without charge.

SSM Health has also changed its procedures to require an additional identifier to be used when patients request prescription refills via its call center. Internal policies and procedures have been reviewed and employee access monitoring tools have been strengthened to ensure any future illegal employee activity is identified more rapidly.

The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights and law enforcement has been notified.

SSM Health privacy officer, Scott Didion, said, “We take very seriously our role of safeguarding our patients’ personal information, and we deeply regret any inconvenience or concern this situation may have caused our patients.”

This is the second incident to be reported by SSM Health this year. In May, SSM Health reported that an electromyography device containing the PHI of 836 patients had been stolen from DePaul Hospital St Louis in Bridgeton, MO.

The post 29,000 Patients Notified of Employee-Related Data Breach at SSM Health appeared first on HIPAA Journal.

A family and sports medicine practice in Colorado has discovered a hacker gained access to its systems and encrypted files with ransomware.

Longs Peak Family Practice (LPFP) in Longmont CO, identified suspicious activity on its network on November 5, 2017 and took rapid action to secure its systems. However, before that was possible, the attacker ran ransomware code which encrypted files on certain parts of its network.

LPFP was prepared for such attacks, and was able to recover the encrypted files and rebuild its systems from backups. However, five days after the initial intrusion was detected, LPFP discovered a second attack had occurred, and its systems had been accessed in a second attack. Ransomware was not involved in the second incident.

While the first incident was dealt with internally, when the second attack was discovered, LPFP called in a leading computer forensics form to assist with the investigation, conduct scans for malware and backdoors, and ensure that unauthorized access to its systems was blocked.

That investigation revealed that an unauthorized individual had accessed certain parts of LPFP’s network on November 5, 9, and 10^th. The forensic investigation took until December 5 to complete, but did not uncover any specific evidence to suggest the attacker had opened any files or stolen data.

However, it was not possible to rule out data access and theft with 100% certainty, and while no evidence was uncovered to suggest the ransomware infection did anything other than blindly encrypt files, it is possible that the malware could have been used to download some computer files.

Files stored on the compromised computers included the following patient information: Names, addresses, email addresses, driver’s license details, Social Security numbers, dates of birth, internal patient ID numbers, insurance carriers, insurance payment codes and costs, dates of service, copies of notes made by LPFP physicians and other healthcare providers, medical conditions, medications, diagnoses, data from diagnostic studies, and lab test results.

Potentially, final statements for accounts that had been sent to a collection agency may have been compromised, but no financial information, invoices for medical services, or credit/debit card details were exposed.

LPFP had already implemented a range of defenses to prevent the unauthorized accessing of patient data, but these attacks revealed vulnerabilities existed in its defenses.  Those vulnerabilities have now been addressed and changes have been made to how its network can be accessed. A new, enhanced firewall has been purchased and implemented, further training is being provided to staff on privacy and security, and the practice is looking into further tools and procedures that will help to improve security.

Due to the sensitive nature of the information that was potentially accessed, LPFP is offering patients 12 months of identity theft repair and credit monitoring services through AllClear without charge.

The post Colorado Practice Hacked Twice in a Week appeared first on HIPAA Journal.

University of Rochester Medicine’s Jones Memorial Hospital in Wellsville, NY is currently experiencing a cyberattack that has caused unexpected downtime.

The attack is understood to have started on Wednesday December 27 and has caused disruption to some of its information services. At the time of writing, the nature of the cyberattack is unclear and it has yet to be resolved.  The cyberattack is limited to Jones Memorial Hospital. No other locations have been impacted.

While some systems are unavailable, Jones Memorial Hospital has announced on its website that the financial and medical information of its patients does not appear to have been compromised. If the investigation concludes that there has been a breach of health information, patients will be notified accordingly. Further information on the attack will also be posted on the hospital’s website as and when new information becomes available.

The hospital notified law enforcement and the New York State Department of the attack when its systems went down. Hospital IT staff are being assisted by the IT departments at the University of Rochester, St. James Hospital, and Noyes Health to restore all systems back to full functionality.

Jones Memorial Hospital has prepared for incidents such as this. Emergency procedures are regularly tested, and employees are trained how to respond to cyberattacks and system downtime. Consequently, medical services are continuing to be provided, with information being recorded manually on patient charts while its systems are offline.

However, without access to electronic patient health information, the hospital is advising all patients to bring their insurance card with them, as well as full lists of medications and if possible, details of their medical history.

Systems will be brought back online as soon as is possible, but in the meantime, the hospital is focused on maintaining patient safety and quality of care.

The post Jones Memorial Hospital Alerts Patients to Ongoing Cyberattack appeared first on HIPAA Journal.

Children’s Hospital Los Angeles is notifying parents of a privacy breach that saw the protected health information (PHI) of children disclosed to incorrect insurance payors.

The privacy breach was discovered on November 29, 2017, with notifications sent to affected patients on December 19.

The impermissible disclosure of PHI included names, addresses, medical record numbers, birth dates, dates of service, and descriptions of the services provided.

Upon discovery of the privacy breach, the insurance payors were contacted and instructed to delete the information. Satisfactory assurances have been received that the information has now been deleted and the medical records of affected patients have been updated to include correct payor information.

No reports have been received to suggest any of the disclosed information has been used inappropriately; however, out of an abundance of caution, affected patients have been offered credit monitoring/protection services with ID Experts without charge.

In the breach notification letters, parents have been advised to monitor insurance communications, including Explanation of Benefits statements, for any services that have not been received by their children and to be alert to the possibility of inappropriate use of their child’s PHI.

The incident has prompted Children’s Hospital Los Angeles to re-enforce education of vendors and staff on the importance of safeguarding patient information.

The incident has been reported to the California Attorney General’s Office and will be reported to the HHS’ Office for Civil Rights. At this stage it is unclear exactly how many individuals have been impacted by the incident.

The post Children’s Hospital Los Angeles Alerts Parents to Impermissible Disclosure of Children’s PHI appeared first on HIPAA Journal.

A dental practice in Reno, NV has experienced a ransomware attack that prevented dental records and images from being accessed for five days.

Wager Evans Dental experienced the ransomware attack on October 30, 2017. The malicious software was installed on one computer and one server used by the practice.

Ransomware can be installed in a number of ways, although most commonly attacks occur via email. That appears to be the case with this attack, with the practice suspecting ransomware was downloaded when an employee clicked on a malicious hyperlink or email attachment.

IT staff and other experts were able to restore the encrypted files and remove the ransomware, although the process took five days. Access to patient records and images was not regained until November 4.

The files encrypted by the ransomware contained sensitive information such as names, dates of birth, addresses, diagnoses, treatment plans, images, health insurance information, and Social Security numbers.

A comprehensive investigation of the attack was conducted and while it is possible that data could have been viewed by the attackers, the sole intention of the attack appears to be an attempt to extort money from the practice.

The investigation into the breach is ongoing, although so far there are no indications that the attackers viewed or stole PHI. Since it is not possible to determine with absolute certainty that data access/theft did not occur, all patients have been notified of the attack, and out of an abundance of caution, those individuals have been offered credit monitoring services for one year without cost.

The attack has prompted the practice to enhance its security to prevent similar incidents from occurring in the future. In the breach notification letter, Brian E. Evans, DDS, said “We have retained security experts and made significant upgrades to our network and computer security.

The post Access to Dental Records Lost for 5 Days Due to Ransomware appeared first on HIPAA Journal.