A mailing error by a subcontractor of Missouri Care Inc., has resulted in the protected health information of 1,223 participants being impermissibly disclosed to other individuals. The MO HealthNet-managed care plan was informed of the breach by O’Neil Printing on July 20, 2017. The privacy breach has been attributed to a software programming error.

The error potentially resulted in the names, birth dates, MO HealthNet ID numbers and Missouri Care member ID numbers of Medicaid recipients being mailed to incorrect recipients. The Missouri Department of Social Services has confirmed that Social Security numbers, financial information and medical information were not involved.

O’Neil Printing identified the cause of the error and has since corrected its software to prevent further mis-mailings. The error only affected mailings on July 11 and July 13, 2017.

Missouri Care has been working closely with MO HealthNet to ensure affected individuals were notified promptly. Letters informing participants of the privacy breach were recently sent in the mail, well within the deadline of the HIPAA Breach Notification Rule.

There is no reason to suggest any of the disclosed information has been misused in any way, although out of an abundance of caution, all affected individuals have been offered complimentary credit monitoring services for 12 months, the cost of which will be absorbed by Missouri Care. Further information on measures that can be taken to reduce the risk of identity theft and fraud have also been provided to the privacy breach victims, such as monitoring Explanation of Benefits statements for any sign of fraudulent activity.

The post Missouri Care Notifies Medicaid Recipients of Subcontractor Breach appeared first on HIPAA Journal.

A phishing attack on City of Hope has resulted in cybercriminals gaining access to the email accounts of four employees.

The emails made it past spam filtering controls and were delivered to employees on May 31 and June 2, 2017. Four employees responded to the requests and disclosed their login credentials to the attackers. City of Hope says the emails appeared to have been sent from a trustworthy source.

The attackers used the login credentials to access the accounts, although City of Hope was unable to determine the scope or nature of access. On July 21, City of Hope confirmed that three of the accounts contained patients’ protected health information.

The protected health information in the emails included names, addresses, email addresses, contact telephone numbers, dates of birth, dates of service, diagnoses, test results, medication information, and other clinical data. No financial information, insurance details, or Social Security numbers were exposed or accessed.

Phishing attacks such as this are not always concerned with obtaining protected health information. Oftentimes, access to the email accounts is gained in order to use the accounts to send spam emails. City of Hope believes that was the intention of the phishers in this case.

However, since PHI access cannot be ruled out, patients affected by the incident have been advised to remain cautious and monitor their accounts for any sign of suspicious activity. The incident has been reported to law enforcement and a leading forensic information technology firm has been retained to assist with the investigation. The firm will also evaluate City of Hope systems and processes and will assist with strengthening existing security protections to prevent future incidents of this nature from occurring.

The breach has now been reported to the Department of Health and Human Services’ Office for Civil Rights (OCR). The breach summary indicates 3,400 patients have been impacted by the incident.

OCR Highlights the Importance of Regular Security Awareness Training for Healthcare Employees

In its July Cybersecurity Newsletter, OCR reminded covered entities of the importance of providing security awareness training to employees to help prevent attacks such as this from resulting in PHI being compromised.

Security awareness training for the workforce is a requirement of the HIPAA Security Rule and employees should receive regular training to help them identify phishing attacks and other security threats.

OCR suggested the frequency of training should be dictated by the findings of risk analyses, although it was pointed out that many healthcare organizations are conducting biannual training and are issuing monthly security bulletins to employees on the latest threats.

OCR suggests employee security awareness training should include computer-based training, classroom sessions, monthly newsletters, security bulletins, posters, and team discussions, although which training methods are used is left to the discretion of the covered entity.

Security awareness training should be documented, with attestations obtained from employees to prove training has been received. Documentation will be required by OCR if a covered entity is selected for an audit or as part of an investigation into a data breach.

The post 3,400 Patients’ PHI Potentially Compromised in City of Hope Phishing Attack appeared first on HIPAA Journal.

Cincinnati’s UC Health has discovered a former employee of its Daniel Drake Center for Post-Acute Care had been accessing the medical records of its patients without authorization for almost two years.

The first recorded instance of inappropriate access occurred on July 29, 2015, with periodic access continuing until June 2, 2017. During that time, the medical records of 4,271 patients had been accessed without authorization or any legitimate work reason for doing so.

The types of information accessed by the individual included patients’ names, medical record numbers, birth dates, lab test results, diagnoses, treatment information and other clinical data. However, financial information and Social Security numbers were stored separately and were not accessed.

Due to the range of data that was accessed, patients have been offered credit monitoring and identity theft protection services through Experian for a period of one year without charge. Patients affected by the privacy breach were notified by mail on August 1.

UC Health reports that the employee was terminated as soon as it was confirmed that medical records had been inappropriately viewed. Action has also been taken to prevent future insider breaches from occurring, including the implementation of additional access controls and the provision of further training to staff members on hospital policies covering medical record access and patient confidentiality.

UC Health will also now be monitoring employee ePHI access more proactively to ensure any future privacy breaches are identified quickly.

As the Protenus Mid-Year Breach Barometer report shows, insiders cause more healthcare data breaches than cyberattacks by hackers. In the first six months of 2017, 41% of healthcare breaches were caused by insiders, resulting in the privacy of 1.17 million patients being violated.

Detecting insider breaches promptly can greatly reduce the number of patients whose privacy is violated and the harm caused to those individuals.

Software solutions capable of detecting improper access can be expensive to implement, although they are an effective deterrent that can prevent many breaches. Detecting privacy violations promptly also reduces the cost of breach mitigation.

Healthcare organizations are required by HIPAA to regularly monitor ePHI access logs for improper access. While HIPAA does not state how often checks should be completed, healthcare organizations should consider conducting a bi-annual review to check for inappropriate access and should not wait for a privacy incident to occur to update their policies.

The post 4,271 UC Health Patients Notified of Insider Data Breach appeared first on HIPAA Journal.

Northwest Rheumatology of Tuscon, Arizona has announced that some of its computer systems were taken out of action following a ransomware infection on April 10, 2017.

Following any ransomware attack, HIPAA-covered entities must conduct an investigation to determine the extent of the attack and whether patient’s protected health information has been compromised. If a covered entity can determine with a high degree of certainty that protected health information has not been accessed, viewed or stolen – or in the case of ransomware ePHI was not encrypted – patients do not need to be notified and a report does not need to be sent to Office for Civil Rights.

When the attack was discovered, Northwest Rheumatology called on its computer security vendor to complete a full investigation into the attack to determine the extent to which data had been encrypted and if any PHI had been compromised.

Northwest Rheumatology was informed by its vendor that the ransomware attack was limited and no protected health information had been encrypted, accessed or copied. Consequently, patient notifications and an OCR breach report were not issued.

However, on June 18, 2017, the healthcare provider uncovered evidence to suggest its systems had been compromised. Northwest Rheumatology hired an independent computer forensics firm to conduct an investigation and the firm confirmed on July 6 that system access had been gained, and potentially, ePHI could have been accessed.

Northwest Rheumatology reports no evidence was uncovered to suggest unauthorized individuals gained access to ePHI or that ePHI was stolen, but the possibility could not be ruled out.

Patients whose protected health information was exposed have now been notified of the security incident by mail and have been offered credit monitoring and identity theft restoration services for 12 months without charge.

The incident has now been reported to Office for Civil Rights, although it has yet to appear on the OCR breach portal so it is currently unclear how many patients have been impacted.

This is one of three recent incidents involving ransomware that were initially thought to have only resulted in file encryption, only to be later discovered that system access was also gained. An investigation into a ransomware attack on Women’s Health Care Group of Pennsylvania revealed access to its systems had been gained four months previously. An investigation into a ransomware attack on Peachtree Neurological Clinic revealed its systems had been compromised for 15 months.

The post Northwest Rheumatology Discovers PHI Potentially Accessed During Ransomware Attack appeared first on HIPAA Journal.

A response to a phishing email has resulted in the PHI of 2,789 Kaleida Health patients being made accessible to cybercriminals.

Kaleida Health discovered the attack on May 24, 2017, prompting a full investigation which involved hiring a third-party computer forensic firm. An analysis of its systems showed that by responding to the phishing email, the employee had provided access to his/her email account.

While access to Kaleida Health’s EHR was not gained, the email account contained a range of protected health information of a small subset of its patients. The types of data in the account varied for each patient, but may have included names, dates of birth, medical record numbers, diagnoses, treatment and other clinical data. However, no financial information or Social Security numbers were exposed at any time.

While access to the email account was possible, no evidence was uncovered to suggest that the emails were accessed or any protected health information was viewed or copied. However, since the possibility of data access could not be ruled out with a high degree of certainty, all affected patients have been notified of the incident by mail.

Phishing has grown to be one of the most serious threats to healthcare organizations. As we have already seen this year, record numbers of successful W-2 phishing attacks have been reported and many healthcare employees have fallen for these phishing scams.

Providing security awareness training to employees can help to reduce risk, although a single training session every year is no longer sufficient. Training must be an ongoing process. As OCR suggested in its July Cybersecurity Newsletter, biannual training sessions should be provided along with monthly security bulletins that highlight the latest security threats.

Classroom-based training may not be the most effective way of raising awareness and developing a security culture in an organization. If computer-based training is provided and employees’ knowledge is tested with phishing simulation exercises, any phishing failures can be turned into training opportunities. These simulations also help to improve knowledge retention.

There are many solution providers that offer training programs and phishing simulation software, including PhishMe, KnowBe4, Wombat Security, PhishLabs, Agari, IronScales and PhishLine.

It may not be possible to reduce risk to zero, but several of those providers have been able to demonstrate that phishing simulation exercises along with employee awareness training can reduce susceptibility to phishing attacks by up to 95%.

The post Phishing Email Response Compromises PHI of 2,800 Patients appeared first on HIPAA Journal.