Another healthcare organization has experienced a ransomware attack in which the protected health information of patients was potentially accessed. Ransomware is typically installed for the purpose of extortion rather than the theft of data; however, even if data theft is not suspected, ransomware attacks are reportable security incidents under HIPAA Rules and patients must be notified per the HIPAA Breach Notification Rule.

Cleveland Medical Associates does not believe any data were stolen in its attack and no evidence has been uncovered to suggest that the PHI of patients was compromised. However, since it is not possible to rule out the possibility of a PHI being accessed with a high degree of certainty, the incident has been reported to the HHS’ Office for Civil Rights and patients are being notified of the cyberattack.

The ransomware attack was discovered on April 21, 2017 with ransomware believed to have been installed the previous evening.  The ransomware was installed on a server than contained the protected health information of 22,000 patients. Medical services were not disrupted as a result of the attack.

A third-party cybersecurity firm was contracted to conduct a forensic investigation of the attack to determine which data were potentially compromised and the extent of the infection. That investigation revealed the server contained names, addresses, contact telephone numbers, Social Security numbers, insurance billing information, email addresses, medical records and other clinical information.

The incident was reported to the FBI and appropriate state and federal agencies have been notified. While data theft is not suspected, as a precautionary measure Cleveland Medical Associates is offering all patients 12 months of complimentary credit monitoring services through Equifax, which include an identity theft insurance policy.

The incident has prompted the healthcare provider to conduct a full review of its security procedures and a new medical record system is now being implemented.

The post Cleveland Medical Associates Attacked with Ransomware appeared first on HIPAA Journal.

The Family Tree Health Clinic in League City, Texas is alerting 13,402 patients that their protected health information was potentially viewed by unauthorized individuals. The attackers gained access to the IT systems of the clinic and downloaded ransomware.

The clinic reports that this was a ‘sophisticated ransomware-encryption’ attack that was quickly remediated. The attack occurred on April 24, 2017 preventing the clinic from accessing its systems. The clinic was prepared for ransomware attacks and had a backup of patients’ protected health information. All encrypted data was restored from those backups and no ransom payment was made.

The clinic has received no reports that any PHI has been misused, although data were potentially accessed by the individuals behind the attack. The types of data that could have been viewed included the patients’ names, addresses, dates of birth, Social Security numbers, medical information including claims and diagnosis codes and health insurance information. Financial information, including credit/debit card numbers, were not stored in the system and remained secured.

After PHI had been restored and the ransomware infection removed, Family Tree Health corrected the security vulnerability that allowed the attackers to gain access to its system. Steps have also been taken to prevent future ransomware attacks from occurring.

The incident was reported to the FBI and the Department of Health and Human Services’ Office for Civil Rights has now been notified of the potential data breach.

Breach notification letters were sent to all affected patients on June 19. No credit monitoring services have been offered, although patients have been provided with further information on how they can secure their accounts and monitor for fraudulent use of their information.

A spokesperson for the clinic said, “Privacy and protection of patient information is a top priority for us, and we deeply regret any inconvenience or concern this incident may cause.”

The post Family Tree Health Clinic Announces Ransomware Attack appeared first on HIPAA Journal.

Experian Health has discovered the protected health information of some patients has been accidentally disclosed to incorrect individuals due to a technical error that occurred during a server migration.

The disclosed data including names, addresses, genders, dates of birth, Medicare ID/HIC numbers, member ID numbers, insurance/payer company names, group numbers/group policy numbers and Medicaid case numbers. The data were shared with incorrect HIPAA covered entities. No information was sent to or otherwise shared with members of the public.

Experian Health took immediate action to address what it refers to as ‘an isolated error’ and reports that the mistake has been corrected. The error affected two platforms used by Experian Health, with data disclosed between February 13 and March 13, 2017.

The information disclosed could only have been accessed or saved by HIPAA-covered entities, who are bound by HIPAA Rules. Therefore, the risk of protected health information being misused is likely to be low.

Experian Health notified affected healthcare institutions of the error on April 28, 2017. One of those entities was Southern Illinois Healthcare (SIH), which was told that 600 of its patients were impacted. Experian Health is a business associate of SIH and performs insurance eligibility verification during patient registration. Experian Health also works with other healthcare organizations.

At present, it is unclear exactly how many patients have been impacted in total since the incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal. It is possible that breach notices will be submitted separately by all of the covered entities impacted by the incident.

SIH has made the decision to offer credit monitoring and credit repair services to all affected individuals as a precautionary measure. Those services, which are being provided through AllClear ID, are available for 24 months without charge.

The post Experian Health Accidentally Sends PHI to Incorrect Individuals appeared first on HIPAA Journal.

Hartford, CT-based health insurer Aetna has discovered the protected health information of more than 5,000 plan members has been exposed online and was accessible through search engines.

Aetna started investigating a security issue affecting two computer services on April 27, 2017. Those services were intended to show documents containing PHI to plan members and other authorized individuals, although it was discovered that the documents had been indexed by search engines and could be viewed by unauthorized individuals.

On May 10, the investigation had uncovered evidence that confirmed a data breach had occurred, with the investigation concluding on June 9. While the investigation into security issues was launched in April, Aetna first became aware of exposed PHI on February 1, according to the San Antonio Express-News. It is unclear why it took almost three months for an investigation to be launched.

Aetna says Social Security numbers, financial information and credit/debit card information was not exposed. The PHI in the documents only included names, identification numbers, member numbers, provider information and claim payment amounts. Some individuals also had dates of service, procedure codes and service codes exposed.

1,708 Ohio and 522 Texas residents are known to have been affected by the breach. In total, the PHI of 5,002 individuals was exposed online, according to the breach report submitted to the Department of Health and Human Services’ Office for Civil Rights.

Aetna has not uncovered evidence to suggest any information has been misused as a result of its exposure online. Action has already been taken to deindex the documents to prevent them from being displayed in search engine results and for cached data to be removed from search engines. Steps have also been taken to prevent the documents from being re-indexed by search engines.

Affected individuals and plan sponsors are now being notified of the data breach by mail.

The post Aetna Error Sees PHI of 5,000 Individuals Exposed Online appeared first on HIPAA Journal.

This month, North Dakota Department of Human Services and Texas Health and Human Services have both reported that patients’ protected health information has been disposed of improperly. Today, another HIPAA-covered entity – Saint Thomas Rutherford Hospital in Murfreesboro, TN – has reported a similar incident.

Documents containing the protected health information of almost 3,000 patients were discovered to have been abandoned by the side of a remote, rural road in DeKalb County in April. The documents were discovered by a member of the public.

Upon being notified of the discarded reports, St Thomas Rutherford Hospital immediately launched an investigation but it is currently unclear how the documents were discarded and who was responsible.

The documents were reports on a sample of 2,859 patient census reports and date between 2009 and 2010.  Affected patients have now been notified of the privacy breach by mail and the incident has been reported to all appropriate authorities.

The documents contained no medical records or Social Security numbers, only each patient’s name, admitting diagnosis, date of birth, physician’s name and account number. Due to the limited nature of data in the documents, Saint Thomas Rutherford hospital does not believe patients face any additional financial risk as a result of the breach.

Cynthia Figaro, Corporate Responsibility Officer and Corporate Privacy Officer of Saint Thomas Health issued a statement about the incident in which she confirmed, “Protecting the privacy of our patient’s information is always a top priority for us at Saint Thomas Health and Ascension,” and sincerely apologized to patients for the privacy violation.

The investigation confirmed that no further disclosures of patient information have occurred and a third-party firm has been contracted to ensure all storage files are appropriately secured until they can be permanently destroyed in accordance with Health Insurance Portability and Accountability Act Rules.

The post 2,859 Patients Impacted by Improper Disposal at St. Thomas Rutherford Hospital appeared first on HIPAA Journal.