Anthem Inc., has only recently settled the lawsuit arising from its 2015 data breach that affected 78.8 million plan holders. Now, thousands of its members are being notified that their protected health information has been exposed in another incident.

This time it was not a cyberattack, but a data breach involving an employee of one of its business associates, Indiana-based LaunchPoint Ventures LLC. LaunchPoint is contracted to provide coordination services, for which it required to be provided with access to plan members’ protected health information.

On April 12, 2017, LaunchPoint became aware that one of its employees was alleged to have been involved in identity theft related activities, prompting the firm to launch an investigation into the possibility of data theft. The business associate hired the services of a third-party forensic firm to assist with the investigation.

On May 28, 2017, LaunchPoint learned that other ‘non-Anthem’ data may also have been compromised. On June 12, 2017, it was confirmed that the PHI of 18,580 Anthem health plan members had been accessed. The information had also been emailed to the employee’s personal email account in July 2016. Anthem was notified of the incident on June 14, 2017.

LaunchPoint has confirmed that the information stolen by the employee includes Medicare ID numbers, Social Security numbers, Medicare contract numbers, health plan ID numbers and dates of enrollment, with ‘a very limited number’ of last names and birth dates also included in the emailed data set.

The employee has been terminated for breaching company polices and LaunchPoint is working closely with law enforcement and assisting with a criminal investigation. Anthem reports that the employee is now behind bars for crimes unrelated to the theft of plan member data. LaunchPoint is assessing its policies and protocols and will be implementing additional safeguards to prevent future security breaches.

Anthem has reported the data breach to the Department of Health and Human Services’ Office for Civil Rights and has issued media notices. The breach impacts individuals in all states where it does business.

LaunchPoint will be sending breach notification letters to all individuals impacted by the incident. Those individuals will be offered credit monitoring and identity theft restoration services without charge for a period of two years.

The post Anthem Business Associate Data Breach Impacts 18,500 Plan Holders appeared first on HIPAA Journal.

A phishing campaign targeting University of Vermont Medical Center (UVMC) has resulted in criminals gaining access to UVMC email accounts. The phishing emails were sent in late May and two employees responded. Doing so allowed the attackers to temporarily gain access to their email accounts. The phishing emails were part of a large campaign sent to many UVMC employees. Fortunately, only two individuals responded. The emails appeared to have been sent from within the organization.

The accounts were compromised on May 22, and on May 24 UVMC detected spam emails being sent from the accounts and shut them down to minimise the damage caused.

The electronic medical record system was not compromised, although the email accounts did contain protected health information (PHI) such as names, medical record numbers, addresses, details of medications, medical diagnoses and treatment information.  No Social Security numbers, insurance information or financial data were compromised.

It is possible that the purpose of the attack was not to gain access to PHI, only to use the email accounts to send spam emails. The spam emails included links to external websites. UVM Health Network’s Head of Internet Security, Heather Roszkowski, suggests the attack may have been conducted to boost traffic to those websites to increase advertising income.

No reports have been received to suggest any information was accessed and misused in any way. However, all affected individuals should exercise caution and monitor their accounts and Explanation of Benefits statements for any sign of fraudulent activity.

All patients impacted by the attack have now been notified of the incident by mail and a substitute breach notice has been uploaded to the UVMC website. That notice indicates approximately 2,300 patients were impacted.

UVMC says that it already has robust security measures in place to prevent attacks such as this, although it will be reviewing those measures to determine whether improvements can be made. UVMC will also be reinforcing training to reduce the probability of employees falling for this type of phishing scam again.

The post Phishing Scam Fools University of Vermont Medical Center Employees into Revealing Login Credentials appeared first on HIPAA Journal.

The price of medical information on the black market may be high, but it is relatively rare for paper records to be stolen during break-ins. However, a burglary at Vision Care Specialists’ administrative offices in Denver, CO saw paperwork containing the PHI of patients taken by thieves.

The burglary was discovered on May 22, 2017 and law enforcement was called in to investigate. An inventory was conducted to determine what items were taken by the thieves and third party forensic investigators were called in to ascertain whether its systems had been accessed. That investigation did not uncover any evidence to suggest electronic medical information had been accessed, although on July 5, Vision Care Specialists discovered that paperwork containing the protected health information of some of its patients had been removed from its offices.

The documents contained a range of sensitive information including names, dates of birth, Social Security numbers, medical information, health conditions/diagnoses, financial information and health insurance details. While no reports have been received to suggest any of the information has been used inappropriately, it can be safely assumed that the information was taken for nefarious purposes.

Vision Care Specialists has now contacted all individuals whose information was obtained by the thieves and all affected patients have been offered complimentary credit monitoring services for 12 months.

Patients affected by the incident have been advised to exercise caution and to monitor their accounts, credit reports and Explanation of Benefits statements and to be alert for identity theft and fraud.

Vision Care Specialists has responded to the incident by enhancing security at its office to prevent any further incidents of this nature from occurring.

The post Protected Health Information Stolen in Vision Care Specialists Burglary appeared first on HIPAA Journal.

A ransomware attack on Peachtree Neurological Clinic (PNC) in Atlanta, GA resulted in the encryption of sensitive data. Since PNC had backed up its data, it was possible to restore the affected files without paying the ransom.

Following any ransomware attack it is important to conduct a forensic analysis of systems to ensure all traces of the ransomware have been removed and no backdoors have been installed. PNC performed scans of its system and confirmed that the malware had been removed; however, the scans revealed that its systems had been accessed by unauthorized individuals between February 2016 and May 2017.

Cybercriminals have been known to gain access to organizations’ systems and install ransomware when there is no further need for access, but it is unclear whether the same individuals were responsible for both security breaches.

PNC found no evidence to suggest that the ransomware attack involved the exfiltration of data, but it was not possible to determine with any degree of certainty whether access to protected health information was gained in the initial attack. PNC was only able to confirm that its systems had been accessed.

The types of protected health information stored on the compromised system included names, telephone numbers, addresses, dates of birth, Social Security numbers, driver’s license numbers, prescription information, details of treatments/procedures and health insurance information.

Due to the sensitive nature of the data that were potentially accessed, PNC has offered all affected individuals complimentary identity theft protection services. The attacks have been reported to law enforcement and all affected individuals have been notified of the incidents by mail.

Dr. Lawrence Seiden, M.D., managing partner of PNC, said, “We take patient privacy seriously, and are very sorry for any concern or inconvenience this incident has caused or may cause to anyone who has been affected.”

The security breaches have yet to appear on the Department of Health and Human Services’ Office for Civil Rights Breach portal so it is unclear how many individuals have been impacted.

The post Ransomware Attack Investigation Reveals 15-Month Security Breach appeared first on HIPAA Journal.

The protected health information of 859 patients of Rosalind Franklin University of Medicine and Science (RFU) has been compromised and potentially been viewed/stolen. The information was stored in two email accounts that were accessed by unauthorized individuals in May.

Access to the email accounts was gained after employees responded to phishing emails. The phishing attack occurred on May 10, 2017 prompting a full investigation. The malicious actors behind the phishing scam gained access to one email account for less than a day and the second email account for a period of 9 days. Access to the second email account was blocked on May 19.

Third party security experts were brought in to assist with the investigation to help determine the full extent of the security breach. RFU is now certain that unauthorized access to sensitive data has been blocked. Part of the investigation involved checking all messages in the compromised email accounts for protected health information.

The investigation confirmed that the compromised PHI was limited to patients’ names, addresses, dates of birth, telephone numbers, medical record numbers, diagnostic information and lab test results. No social security numbers or financial information were compromised.

RFU says it has received no reports of any misuse of information in the accounts, although affected individuals have been advised to remain vigilant and to check their credit reports, account statements and Explanation of Benefits statements for any sign of fraudulent activity.

RFU has reassured patients that security measures had been introduced prior to the attack to protect data stored in its systems and proactive steps have now been taken to address the incident and strengthen security to prevent further successful phishing attacks. RFU has reported the incident to the FBI which is investigating.

An RFU spokesperson said, “The confidentiality, privacy, and security of information within our care is one of our highest priorities.”

The post Rosalind Franklin University of Medicine and Science Phishing Attack Sees PHI Compromised appeared first on HIPAA Journal.