Silver Cross Hospital in New Lenox, IL, has learned that the protected health information of 8,862 patients has been exposed as a result of a software update performed by a business associate that manages certain parts of its website.

The software upgrade was performed on the website in November 2016, which resulted in security settings being inadvertently reconfigured. As a result, information entered by patients in webforms was made available over the Internet and could potentially have been accessed by unauthorized individuals. Silver Cross Hospital said change to the security settings was discovered internally on June 14, 2017. The vendor was immediately contacted and the site was rapidly secured.

A computer forensics firm was contracted to perform an analysis of the website to establish whether any of the exposed information had been accessed by unauthorized individuals during the seven months that data were accessible. The investigation did not uncover any evidence to suggest unauthorized individuals navigated to the forms and viewed patient health information, although the possibility could not be ruled out.

At no point did the security incident affect the hospital’s electronic health record system or any data stored by the hospital. The only information that could potentially be viewed was information entered via the forms and stored by its vendor.

The breach affects patients who used a range of forms on the website. Those forms collected a range of sensitive information including names, addresses, telephone numbers, email addresses, dates of birth, IP addresses and patients’ marital status. Some patients also had their Social Security number, insurance details and some health information exposed, but only if that information had been submitted via the webforms. While the software update occurred in late November, the breach impacts patients who used the webforms between January 2013 and June 14, 2017. In some cases, patients and payment guarantors may have had their information entered into the webforms by a third party and may therefore not be aware that they have been impacted by the incident.

Silver Cross Hospital has now notified all impacted individuals for whom valid contact addresses are held. All individuals affected by the breach have been offered complimentary credit monitoring services for 12 months.

Steps have also been taken to improve security and prevent similar incidents from occurring in the future. Those measures include reviewing and updating policies and procedures related to website security, the provision of additional training for staff members, and a detailed assessment of security practices by experts in the field.

The post Website Update Exposes PHI of 8,800 Silver Cross Hospital Patients appeared first on HIPAA Journal.

Silver Cross Hospital in New Lenox, IL, has learned that the protected health information of 8,862 patients has been exposed as a result of a software update performed by a business associate that manages certain parts of its website.

The software upgrade was performed on the website in November 2016, which resulted in security settings being inadvertently reconfigured. As a result, information entered by patients in webforms was made available over the Internet and could potentially have been accessed by unauthorized individuals. Silver Cross Hospital said change to the security settings was discovered internally on June 14, 2017. The vendor was immediately contacted and the site was rapidly secured.

A computer forensics firm was contracted to perform an analysis of the website to establish whether any of the exposed information had been accessed by unauthorized individuals during the seven months that data were accessible. The investigation did not uncover any evidence to suggest unauthorized individuals navigated to the forms and viewed patient health information, although the possibility could not be ruled out.

At no point did the security incident affect the hospital’s electronic health record system or any data stored by the hospital. The only information that could potentially be viewed was information entered via the forms and stored by its vendor.

The breach affects patients who used a range of forms on the website. Those forms collected a range of sensitive information including names, addresses, telephone numbers, email addresses, dates of birth, IP addresses and patients’ marital status. Some patients also had their Social Security number, insurance details and some health information exposed, but only if that information had been submitted via the webforms. While the software update occurred in late November, the breach impacts patients who used the webforms between January 2013 and June 14, 2017. In some cases, patients and payment guarantors may have had their information entered into the webforms by a third party and may therefore not be aware that they have been impacted by the incident.

Silver Cross Hospital has now notified all impacted individuals for whom valid contact addresses are held. All individuals affected by the breach have been offered complimentary credit monitoring services for 12 months.

Steps have also been taken to improve security and prevent similar incidents from occurring in the future. Those measures include reviewing and updating policies and procedures related to website security, the provision of additional training for staff members, and a detailed assessment of security practices by experts in the field.

The post Website Update Exposes PHI of 8,800 Silver Cross Hospital Patients appeared first on HIPAA Journal.

In June, ransomware was installed on servers and workstations at Salina Family Healthcare in Kansas resulting in the encryption and potential disclosure of patients protected health information.

The attack occurred on June 18, 2017. Salina Family Healthcare was able to limit the extent of the attack by taking swift action to secure its systems. It was also possible to restore the encrypted data from recent backups so no ransom needed to be paid.

A third-party computer forensics firm was contracted to analyze its systems to determine how the ransomware was installed and whether the attackers succeeded in gaining access to or stealing patient data. While evidence of data theft was not uncovered, the firm was unable to rule out the possibility that the actors behind the attack viewed or copied patient data.

The protected health information potentially accessed includes names, addresses, dates of birth, Social Security numbers, medical treatment information, and health insurance details.

While data access was possible, no reports have been received to suggest any information has been stolen and misused, although patients should be alert to the possibility of data theft and should monitor their accounts and Explanation of Benefits statements closely for any sign of fraudulent activity.

Patients potentially impacted by the attack have now been notified of the security breach and have been offered credit monitoring and identity theft restoration services for 12 months without charge out of an abundance of caution.

Salina Family Healthcare has already taken a number of steps to improve security following the ransomware attack. Those measures include upgrading network servers, regularly scanning the network for viruses, providing the workforce with additional security training on malware threats, and limiting Internet access for staff to reduce exposure.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 77,337 patients and payment guarantors have potentially been impacted by the security incident.

The post Ransomware Attack on Salina Family Healthcare Impacts 77,000 Patients appeared first on HIPAA Journal.

Aetna is in the news again for the wrong reasons, having experienced another protected health information breach. The latest incident impacts approximately 12,000 Aetna plan members and resulted in highly sensitive information being disclosed to unauthorized individuals.

An error was made in a recent mailing to plan members. That error resulted in the HIV positive of members being disclosed to other individuals. The letters advised plan members about their options for filling in their HIV prescriptions. However, some of that information was visible through the transparent plastic window in the envelope along with names and addresses. The mailing was sent by a third-party vendor on July 28, 2017.

Aetna was notified of the error by the Legal Action Center and the AIDS Law Project of Pennsylvania, which in turn were notified of the error by some individuals whose HIV status had been disclosed. Those individuals said that in addition to the information being visible to the mailman, the letters had been viewed by roommates, neighbors and family members.

The potential harm caused by an error such as this is considerable. As Ronda Goldfein, executive director of AIDS Law Project of Pennsylvania explained, “It creates a tangible risk of violence, discrimination and other trauma.”

All patients affected by the privacy breach have now been informed of the error by mail. Aetna explained that for some patients, the letter had slipped inside the envelope making the sensitive information visible. Aetna explained to patients that the “mistake is unacceptable” and that a review is now being conducted to ensure similar incidents do not occur in the future.

This breach comes just two months after Aetna announced the discovery of an error that resulted in the protected health information of approximately 5,000 individuals being indexed by search engines and made available to unauthorized individuals over the Internet.

The post Third-Party Mailing Error Sees Aetna Plan Members’ HIV Status Disclosed appeared first on HIPAA Journal.