The Ottawa-based East Central Kansas Area Agency on Aging (ECKAAA) has experienced a ransomware attack that has resulted in the encryption of files on one of the agency’s servers. Those files contained the protected health information (PHI) of 8,750 patients.

The attack occurred on September 5, 2017 and was immediately recognized by ECKAAA, which took prompt action to limit the spread of the infection. As a result, only parts of the server had files encrypted. Those files were discovered to contain names, telephone numbers, addresses, birthdates, Medicaid numbers, and Social Security numbers.

ECKAAA hired a cybersecurity firm to assist with the investigation and determine the true extent and nature of the attack. The investigation revealed the ransomware variant used was a variant of Crysis/Dharma – a ransomware variant known to encrypt files stored locally, on mapped network drives, and unmapped network shares. Crysis/Dharma ransomware also deletes shadow volume copies to hamper recovery.

While the investigation uncovered no evidence of exfiltration of data, the possibility of data access and data theft could not be ruled out. ECKAAA reports that while not all files on the server were encrypted, the attackers potentially had access to all files saved on the server.

Prior to the ransomware attack, ECKAAA had implemented safeguards to protect against malware attacks and to ensure files could be recovered in the event of disaster. Consequently, it was possible to recover all the encrypted files without paying the ransom.

Since the protections in place were not sufficient to block the ransomware attack on this occasion, ECKAAA has implemented a number of new measures to improve security. Those measures include the use of CrowdStrike advanced malware agents and subscription to Cisco Umbrella Insights to improve security monitoring.

Additional training has also been given to staff to improve awareness of the threat from ransomware, a full password reset has taken place, and staff have been reminded about the importance of selecting strong passwords. A review of policies and procedures is also taking place and they will be updated accordingly to reduce the risk of future attacks occurring.

ECKAAA conducted a fully HIPAA-compliant breach response. The incident was reported to the Department of Health and Human Services’ Office for Civil Rights, a substitute breach notice was placed prominently on the ECKAAA website, and media reports were submitted to prominent newspapers serving each of the five counties in which the agency operates. All individuals have now been notified of the potential breach of their PHI by mail.

The post Aging Agency Reports Ransomware Attack: 8,750 Patients Impacted appeared first on HIPAA Journal.

An independent care provider who provides care for patients of TJ Samson Community Hospital in South Central Kentucky, has been discovered to have inappropriately accessed the protected health information (PHI) of 683 patients of TJ Samson Community Hospital in Glasgow, KY and the TJ Health Columbia Clinic.

The inappropriate access was discovered during a routine audit of PHI access logs on August 25, 2017. The subsequent investigation revealed two individuals from the healthcare provider’s office had accessed the protected health information of patients, without any legitimate work reason for doing so.

Access to patients PHI is necessary in order for independent health care providers to conduct their work duties, although in this case, the PHI of patients was accessed even though the patients were not being treated by the individuals.

TJ Samson interviewed both individuals about the alleged unauthorized access and is satisfied that no further uses or disclosures of PHI have occurred.

In response to the incident, TJ Samson has terminated access for the individuals in question. The breach notice posted to the TJ Samson website does not indicate any further action was taken against those individuals, although steps have been taken to prevent similar cases of unauthorized access, which included conducting a review of access procedures for independent health care providers. Individuals whose PHI was viewed have been notified of the breach of their confidential information by mail.

The types of information accessed included names, medical information, demographic information, and in some cases, Social Security numbers and insurance information. The access dated back to January 1, 2017. No financial information was accessed as the individuals’ login credentials did not permit them to access such information.

The post TJ Samson Community Hospital Discovers Inappropriate Accessing of 683 Patients’ PHI appeared first on HIPAA Journal.

Briggs Stratton Corporation, a manufacturer of lawnmower engines, may not appear to be a HIPAA covered entity since the firm is not in the healthcare industry and does not provide services to healthcare organizations as a business associate. However, the company is required to comply with HIPAA Rules.

When the company experienced a potential breach of employee information, the incident was a reportable security breach, OCR required notification, and notification letters had to be issued to its employees. Just because a company does not operate in the healthcare industry does not mean that HIPAA does not apply.

Briggs Stratton was required to comply with HIPAA Rules due to its self-insured group health plan. Employers and health plan sponsors are required to ensure that HIPAA policies are put in place for their group health plans, that any ePHI created, accessed, stored, or transmitted is safeguarded to the standards required by the HIPAA Security Rule and all HIPAA Rules are followed. That includes entering into business associate agreements with any entity that has access to the ePHI of its employees, is provided with ePHI, or has access to systems containing ePHI.

When there is a breach of that information, the HIPAA Breach Notification Rule applies. In the case of Briggs Stratton, the breach was a hacking/IT incident resulting a potential unauthorized disclosure of ePHI. Malware was discovered on its systems which potentially gave unauthorized individuals access to the system where ePHI was stored. Access to the system was possible between July 25 and July 28, 2017. Briggs Stratton became aware of the incident on July 25, and took steps to contain the attack. Notifications were delayed until September 30, 2017 due to a law enforcement investigation into the malware attack.

The breach impacted 12,789 of its employees and potentially resulted in the exposure of names, addresses, dates of birth, driver’s license numbers, Social Security numbers, health plan IDs, insurance information, passport numbers, work-related evaluations, and login details to its work systems. No evidence of misuse of any health plan data has been uncovered, although employees impacted by the breach have been offered credit monitoring and identity theft protection services for 12 months without charge. Steps have also been taken to improve security to prevent similar incidents from occurring in the future.

The incident serves as a reminder that not all HIPAA covered entities fall under the standard classification of healthcare providers, health plans or business associates, and even firms not involved in healthcare may still be required to comply with HIPAA Rules and can face penalties for non-compliance with HIPAA Rules.

In the case of Briggs Stratton, the firm was well aware of its responsibilities, had implemented a HIPAA compliance program, and acted accordingly when a potential data breach occurred.

The post Lawnmower Engine Manufacturer Reports HIPAA Breach appeared first on HIPAA Journal.

A limited amount of protected health information (PHI) of almost 8,000 patients of Brevard Physician Associates has been exposed after a desktop computer was stolen in a burglary.

The incident occurred on September 4, 2017 – Labor Day – when the offices were closed. In the early morning, thieves broke in and stole three desktop computers.

The burglary triggered the alarm system and police responded to the incident, although not in time to apprehend the criminals. A forensic analysis of the office was performed, although to date the individuals responsible have not been apprehended and the computers not recovered.

Two of the computers did not contain any protected health information, but the third computer had five audit files saved to the hard drive. The information in those audit files was limited, although there was sufficient information to warrant the issuing of breach notifications to patients.

Brevard Physician Associates acted quickly and dispatched breach notification letters to affected patients well within the timeframe allowed by the HIPAA Breach Notification Rule. In total, 7,976 patients were potentially impacted and had the following information exposed: Names, names of insurance providers, CPT codes for the services provided, and the amounts charged for services.

The HIPAA Security Rule does not demand the use of encryption, although if the decision is taken not to encrypt data, an alternative, equivalent control must be employed to safeguard the confidentiality, integrity, and availability of PHI. While the computers were not encrypted, they were protected with passwords and strong passwords had been used. Brevard Physician Associates also reports that the devices can be remotely wiped of all data, and that safeguard has been triggered. If the devices are connected to the Internet, data will be remotely wiped.

Brevard Physician Associates believes the risk – and future risk – of identity theft and fraud as a result of the incident is minimal. Even though addresses, dates of birth, telephone numbers, Social Security numbers, financial information and insurance ID numbers were not exposed and could not be accessed by the thieves, the decision has been taken to offer all affected patients 12 months of complimentary credit monitoring services.

Brevard Physician Associates should be commended for its rapid breach response, prompt issuing of notifications, and for the steps taken to mitigate risk.

The post 8,000 Patients Notified of PHI Exposure After Office Burglary appeared first on HIPAA Journal.

The protected health information (PHI) of 932 members of the Texas Children’s Health Plan has been discovered to have been emailed to the personal email account of a former employee.

The incident was discovered on September 21, 2017, although the former employee emailed the data late last year in November and December 2016. The emails were discovered during a routine review.

Texas Children’s Health Plan responded to the breach promptly and has taken action to mitigate risk. The health insurance plan has also implemented additional safeguards to prevent similar incidents from occurring in the future and employees have been re-trained on hospital policies and HIPAA Rules.

While the reason for the PHI being emailed to the personal email account has not been disclosed, the breach report uploaded to the insurance plan website explains no evidence has been uncovered to suggest any plan member information has been used inappropriately. However, the incident has been reported to law enforcement.

As is required by the HIPAA Breach Notification Rule, the incident has been reported to the Department of Health and Human Services’ Office for Civil Rights and all patients impacted by the incident have been notified by mail. Breach notification letters were dispatched to patients on Friday, October 27, well inside the maximum deadline allowed by the HIPAA Breach Notification Rule.

The types of data included in the emails varied for each patient, but typically included: Names, telephone numbers, addresses, dates of birth, Medicaid numbers, waiver type, STAR kids manager’s name and group, and information detailed in a budget worksheet. No financial information nor Social Security numbers were included in the emails, although for a small number of patients, the following information was also included: Medical record numbers, medical diagnoses, and clinical information.

This type of incident is relatively common. Several HIPAA-covered entities have discovered similar incidents in recent months. Oftentimes, PHI is taken to provide to a new employer to recruit patients to a new practice and some cases have seen PHI emailed to friends and relatives for assistance with data processing tasks. Some healthcare employees have stolen data with a view to committing identity theft and fraud.

HIPAA-covered entities should be monitoring for PHI theft via email. Ideally, restrictions should be put in place to prevent PHI from being emailed outside the organization.

The post 932 Texas Children’s Health Plan Members’ PHI Emailed to Personal Account by Employee appeared first on HIPAA Journal.