In June, ransomware was installed on servers and workstations at Salina Family Healthcare in Kansas resulting in the encryption and potential disclosure of patients protected health information.

The attack occurred on June 18, 2017. Salina Family Healthcare was able to limit the extent of the attack by taking swift action to secure its systems. It was also possible to restore the encrypted data from recent backups so no ransom needed to be paid.

A third-party computer forensics firm was contracted to analyze its systems to determine how the ransomware was installed and whether the attackers succeeded in gaining access to or stealing patient data. While evidence of data theft was not uncovered, the firm was unable to rule out the possibility that the actors behind the attack viewed or copied patient data.

The protected health information potentially accessed includes names, addresses, dates of birth, Social Security numbers, medical treatment information, and health insurance details.

While data access was possible, no reports have been received to suggest any information has been stolen and misused, although patients should be alert to the possibility of data theft and should monitor their accounts and Explanation of Benefits statements closely for any sign of fraudulent activity.

Patients potentially impacted by the attack have now been notified of the security breach and have been offered credit monitoring and identity theft restoration services for 12 months without charge out of an abundance of caution.

Salina Family Healthcare has already taken a number of steps to improve security following the ransomware attack. Those measures include upgrading network servers, regularly scanning the network for viruses, providing the workforce with additional security training on malware threats, and limiting Internet access for staff to reduce exposure.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 77,337 patients and payment guarantors have potentially been impacted by the security incident.

The post Ransomware Attack on Salina Family Healthcare Impacts 77,000 Patients appeared first on HIPAA Journal.

Aetna is in the news again for the wrong reasons, having experienced another protected health information breach. The latest incident impacts approximately 12,000 Aetna plan members and resulted in highly sensitive information being disclosed to unauthorized individuals.

An error was made in a recent mailing to plan members. That error resulted in the HIV positive of members being disclosed to other individuals. The letters advised plan members about their options for filling in their HIV prescriptions. However, some of that information was visible through the transparent plastic window in the envelope along with names and addresses. The mailing was sent by a third-party vendor on July 28, 2017.

Aetna was notified of the error by the Legal Action Center and the AIDS Law Project of Pennsylvania, which in turn were notified of the error by some individuals whose HIV status had been disclosed. Those individuals said that in addition to the information being visible to the mailman, the letters had been viewed by roommates, neighbors and family members.

The potential harm caused by an error such as this is considerable. As Ronda Goldfein, executive director of AIDS Law Project of Pennsylvania explained, “It creates a tangible risk of violence, discrimination and other trauma.”

All patients affected by the privacy breach have now been informed of the error by mail. Aetna explained that for some patients, the letter had slipped inside the envelope making the sensitive information visible. Aetna explained to patients that the “mistake is unacceptable” and that a review is now being conducted to ensure similar incidents do not occur in the future.

This breach comes just two months after Aetna announced the discovery of an error that resulted in the protected health information of approximately 5,000 individuals being indexed by search engines and made available to unauthorized individuals over the Internet.

The post Third-Party Mailing Error Sees Aetna Plan Members’ HIV Status Disclosed appeared first on HIPAA Journal.

There has been a spate of phishing attacks on healthcare organizations in the past few weeks. The increased threat of attacks prompted the Department of Health and Human Services’ Office for Civil Rights to issue a warning to healthcare organizations, urging them to improve their defenses by conducting regular security awareness training sessions for employees.

Phishing is the number one attack vector for delivering malware and successful attacks can result in the theft of considerable amounts of sensitive data. Email accounts contain a wide range of sensitive data on patients – information that can be used to commit identity theft and medical fraud, although oftentimes attacks are conducted to gain access to emails accounts for the purposes of spamming.

In the case of the phishing attack on MJHS, the motive of the malicious actor is unknown. Fortunately, rapid identification and mitigation of the attack limited the attacker’s window of opportunity. The compromised email accounts were secured before the accounts could be used to send any emails, although it is possible that the protected health information of patients/plan members may have been viewed.

On June 6, 2017, MJHS learned that an unauthorized individual gained access to the email accounts of several employees of Elderplan Inc., and on June 14, 2017 it was discovered that access was also gained to an email account of a MJHS Home Care employee.

MJHS called in a leading third-party forensic firm to assist with the investigation and determine whether any emails had been accessed or forwarded. The firm was unable to detect any suspicious activity during the short time that access to the Elderplan and MJHS Home Care email accounts was possible.

Inspection of the emails in the compromised accounts showed they contained individuals’ names, diagnoses, Medicare numbers, insurance information, treatment dates and the facilities where treatment was provided. MJHS has notified all individuals impacted by the phishing attack and has offered complimentary credit monitoring services for 12 months through Kroll.

MJHS explained to patients that no evidence was uncovered to suggest any ePHI was viewed, stolen or misused by the attacker, although as a precaution, affected individuals have been advised to monitor their Explanation of Benefits statements closely for any sign of fraudulent activity.

The phishing attack has now been reported to Office for Civil Rights. The breach reports show 22,000 Elderplan members have been affected along with 6,000 patients of MJHS Home Care.

The post MJHS Phishing Attack Result in the Exposure of 28,000 Individuals’ PHI appeared first on HIPAA Journal.

Another healthcare organization has been attacked with ransomware, resulting in the protected health information of almost 34,000 patients being encrypted and made inaccessible.

St. Mark’s Surgical Center in Fort Myers, FL experienced the ransomware attack on April 13, 2017, which prevented patient data from being accessed until April 17, 2017. The ransomware was installed on the center’s server which contained patient’s names, dates of birth, Social Security numbers and treatment information.

An investigation into the breach was immediately conducted to determine the extent of the attack and to find out which data had been encrypted and the number of patients impacted. That investigation revealed the protected health information of 33,877 patients was potentially accessed by the attackers.

A third-party cybersecurity firm was called in to assist with the removal of the ransomware and to conduct a thorough forensic investigation. The firm was able to confirm that all traces of the malware were removed and further access to the server was blocked.

The firm also investigated whether the attack involved the accessing or theft of patient data. The investigation did not uncover any evidence to suggest any health information was stolen or viewed by the attackers, although the possibility could not be ruled out with a high degree of certainty.

As the Department of Health and Human Services’ Office for Civil Rights has explained in its guidance on ransomware and subsequent blog posts, any ransomware attack that involves the encryption of ePHI is usually reportable. St. Mark’s Surgical Center followed that guidance and reported the security incident and notified all patients affected by the security breach to allow them to take action to minimize the possibility of misuse of their data.

All patients affected by the incident have also been offered complimentary credit monitoring and related services as an additional precaution against identity theft and fraud.

Prior to the attack, St. Mark’s Surgical Center had taken steps to reduce the risk of malware and ransomware incidents, although the attackers managed to bypass those defenses. To reduce the risk of future attacks, St. Mark’s Surgical Center has taken a number of steps to improve security, including purchasing a more robust firewall, improving patch management policies and ensuring all systems are protected by the latest antivirus software. Unified threat management services are also being used and a new backup and disaster recovery system has been implemented, which performs hourly backups and stores copies of those backups offsite in redundant data centers.

The substitute breach notice indicates the medical center learned of the extent of the attack on May 8, 2017, although the breach report on the Office for Civil Rights website shows the notice was submitted on August 9.

The maximum allowable time for notifying OCR and patients of a breach of ePHI is 60 days from the discovery of the breach, although covered entities should not delay the issuing of breach notifications unnecessarily.

Deven McGraw recently explained that breach notification delays are violations of HIPAA Rules, even when breach notices are issued within 60 days. If HIPAA covered entities delay the issuing of breach notices they risk a financial penalty for the violation, as Presense Health discovered. A one-month delay in issuing breach notifications resulted in a settlement of $475,000.

The post 34,000 Impacted by Ransomware Attack at St. Mark’s Surgical Center appeared first on HIPAA Journal.

Ransomware attacks on healthcare organizations have increased, although that is far from the only malware threat. Keylogging malware can be used to obtain sensitive information such as login credentials, or in the case of the San Antonio Institute for Women’s Health (IFWH), credit and debit card information as it was entered into its system.

The keylogging malware was discovered on the IFWH network on July 6, 2017, prompting a forensic investigation of its systems. That investigation revealed the malware had been installed on June 5, although it took until July 11 for the malware to be removed from the majority of its systems and a further two days for IFWH to confirm that the malware had been completely removed from all terminal servers and workstations.

During the time that the malware was present, it recorded and transmitted sensitive data as information was entered into its system. The types of data recorded by the malware between June 5 and July 11 includes names, dates of birth, addresses, Social Security numbers, scheduling notes, current procedural technology and other billing codes and other information that was entered into its system between those dates.

Any patient that paid for medical services using a credit or debit card between the above dates may have had their card data captured by the malware. IFWH said the incident was limited to information entered internally via keyboards. Data entered into its patient portal was not obtained by the hackers.

The Department of Health and Human Services has been informed of the breach and the incident has been reported to the Federal Bureau of Investigation. All patients impacted by the incident have now been notified of the breach by mail and have been offered identity theft protection services via ID Experts MyIDCare program. Patients will also benefit from 12 months of credit monitoring services and protection with a $1,000,000 insurance reimbursement policy.

Since credit card details were obtained, patients have been requested to contact their credit card companies and work with them to resolve any fraud issues and secure their accounts.

IFWH issued a statement confirming layered security defenses had been implemented prior to the malware attack, but those controls failed to prevent the virus from being installed. Those measures included network filtering and security monitoring solutions, firewalls, antivirus solutions and password protection. The malware attack has prompted IFWH to bolster its defenses to prevent further breaches, including enhancing data security on its web server infrastructure.

The post Institute for Women’s Health Hacked: PHI Compromised appeared first on HIPAA Journal.

A log book containing the protected health information of approximately 750 obstetrics patients of TriPoint Medical Center in Concord Township, Ohio has been discovered to be missing.

All obstetrics departments are required by the Ohio Department of Health to maintain a log book detailing deliveries. The log book contained only limited protected health information of patients and the loss/theft of the logbook did not result in the exposure of any highly sensitive information such as Social Security numbers, financial information, or details of health insurance.

However, out of an abundance of caution, all individuals affected by the incident have been notified of the breach by mail and have been offered membership to an identity theft protection program for 12 months without charge.

Lake Health, which operates the medical center, was informed of the lost logbook in June and launched an investigation and conducted a risk assessment the same day. While the logbook has not been located, Lake Health has confirmed that none of the information in the log book has been lost. All information is transferred from the log book to its computer system and the digital copies are stored securely.

The Ohio Department of Health does not stipulate that log books be maintained in physical form. To improve security, Lake Health has updated its policies and procedures and the log book is now maintained in secure, digital form. Additionally, the incident has prompted Lake Health to provide further training for all obstetrics department employees on privacy and security.

Marketing and Business Development Senior Vice President Richard D. Cicero issued a statement saying Lake Health “deeply regrets this incident” and is committed to protecting the privacy and security of patients’ sensitive information. He explained, “We have rigorous processes and procedures in place to detect breaches of patients’ rights and to protect patients in the event of a breach.”

The post Lake Health Informs OB Patients of TriPoint Medical Center Breach appeared first on HIPAA Journal.