The Tacoma, WA-based MultiCare Health System has announced that the email account of one of its employees has been compromised by a hacker following a successful phishing attack.

The five-hospital health system issued a statement yesterday about the email security breach confirming patients’ protected health information had been compromised. It is unclear when access to the email account was first gained, although the email security breach was discovered by MultiCare Health on November 27, 2016.

An investigation into the breach was immediately launched and rapid action was taken to secure the health system’s email accounts, including resetting passwords on all email accounts. However, the investigation revealed that only one email account had been compromised.

An analysis of the email account revealed that emails contained the ePHI of 1,200 former and current patients. Data potentially accessed by the attacker included patients’ names, addresses, dates of birth, genders, dates of service, account balances, and diagnosis and treatment information. MultiCare has confirmed that the compromised email account contained no Social Security numbers or financial information.

Patients are in the process of being notified of the security breach by mail and have been advised to check their Explanation of Benefits statements and to report any irregularities. To date, MultiCare has not received any reports of misuse of patients’ information.

Phishing attacks on healthcare organizations are to be expected. It is therefore essential for healthcare organizations to make employees aware of the risk of phishing and how to identify potential phishing attacks. Phishing simulation exercises are highly effective at reinforcing training and can greatly improve detection of phishing emails. Healthcare organizations should also set up a system of reporting potential phishing emails. Fast detection can help to prevent other employees from falling for the scams.

To counter the threat and prevent similar incidents from occurring in the future, MultiCare Health is reinforcing the education and training of its employees and will be providing staff members with additional training on phishing email detection. A review of security practices and procedures and ePHI safeguards has also been scheduled.

The post Email Account Compromised: 1,200 MultiCare Patients’ ePHI Exposed appeared first on HIPAA Journal.

Roper St. Francis Mount Pleasant Hospital in South Carolina has discovered that a digital camera used to take photographs of new born babies has been lost and potentially stolen.

As is recommended by the National Center for Missing and Exploited Children, photographs of new born babies are taken by hospital staff for security reasons. In the event that a baby goes missing, the digital images can be used for identification purposes. According to hospital spokesperson Andy Lyons, the camera was stored in a secure location in the hospital not accessible by the general public.

Following the discovery that the camera was missing, an extensive search of the hospital was conducted, although the missing camera has not yet been located.

The camera stored images on a memory card which was in the device when it went missing. The memory card is believed to contain the images of approximately 500 babies born at the hospital between November 2015 and November 2016. The photos also contained physicians’ names, the birthdate of each baby, and the babies’ names.

Parents of the babies are being notified of the privacy breach in accordance with Health Insurance Portability and Accountability Act Rules and a HIPAA breach notice has been sent to the Department of Health and Human Services’ Office for Civil Rights. Roper St. Francis Mount Pleasant Hospital has not received any reports to suggest any of the data stored on the device have been used inappropriately.

According to a statement released by the hospital, action has been taken to prevent similar incidents from occurring in the future. Staff members have been provided with additional training on the importance of safeguarding patient information and additional measures have been implemented to protect cameras used by the hospital. The hospital has also strengthened its policies and procedures covering the use, disclosure, and storage of patient information.

The post South Carolina Hospital Reports Loss of Camera Containing Babies’ PHI appeared first on HIPAA Journal.

The protected health information of 600 individuals who received treatment for mental health disorders and/or substance abuse at a Baltimore treatment center has potentially been compromised.

On November 28, 2016, Complete Wellness discovered that highly confidential information had been accessed and copied onto a flash drive without authorization. Even though the treatment center was able to identify the individual responsible, it was not possible to recover the drive as the device was allegedly lost by the employee.

While no reports of misuse of the information contained on the device have been received by Complete Wellness, the possibility remains that the drive has been found and patient data accessed.

Data stored on the device included patients’ names, phone numbers. home addresses, email addresses, ages and dates of birth, languages spoken, ethnicity, race, marital statuses, the names of primary care physicians, emergency contact information, level of education, employer information, hurricane victim status, living situation, arrest history, military service information, and whether individuals had any hearing or vision difficulties. Social Security numbers of patients were also downloaded to the device. Patients affected by the breach had previously received treatment from Leslie Duff CRNP or Durwood Whitten, PhD.

Complete Wellness has since implemented a number of security measure to prevent future privacy breaches from occurring. Those measures included adopting technology to enable sensitive data to be sent securely rather than being transported on portable devices. Encryption technology has been implemented and additional privacy training provided to all administration and clinical staff members. A review of policies and procedures has been conducted and updates made to prevent similar incidents from occurring in the future.

Ongoing discussions have taken place with company leadership to address the security incident and prevent a recurrence. Complete Wellness has also confirmed that the employee was terminated as a result of the incident.

The post ePHI Improperly Accessed, Copied, and Lost by Employee appeared first on HIPAA Journal.

Los Angeles-based Wonderful Health and Wellness has notified patents that their electronic protected health information (ePHI) was exposed in early December, 2016 when an unencrypted laptop computer was stolen from the company’s Wonderful Center for Health Innovation.

Staff at the Center discovered the laptop computer was missing on December 12 when they returned to work after the weekend, with the theft having occurred at some point between December 9 and 12. The theft was immediately reported to law enforcement, although the device has not been recovered.

The laptop contained a range of protected health information including patients’ names along with their home addresses, telephone numbers, dates of birth, email addresses, clinical account numbers, medical conditions, treatment information, treatment dates, and test results. No Social Security numbers or financial information were stored on the device.

While the laptop computer was not encrypted, software had been installed which allows data on the device to be remotely deleted, although only if the laptop is used to connect to the Internet. Wonderful Health and Wellness has programmed the software to delete all sensitive data on the device the next time the device connects.

Patients were notified of the potential ePHI breach on January 18, 2017. At that point, there was no indication that any of the data on the device had been accessed or used inappropriately.

Wonderful Health and Wellness has conducted a review of its strategy for storing and transmitting medical information and additional safeguards have already been implemented to better secure patients’ medical information and prevent future breaches of this nature from occurring.

The incident has yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal, so it is currently unclear how many patients have been impacted by the incident.

The post Theft of Unencrypted Laptop Exposes Wonderful Health & Wellness Patients’ ePHI appeared first on HIPAA Journal.

An unauthorized individual has accessed and downloaded the highly sensitive information of approximately 220,000 osteoarthritis patients from a website database maintained by CoPilot Provider Support Services.

The website is used by physicians to determine whether ORTHOVISC® and MONOVISC® injections are covered by patients’ health insurance. The information entered via the website is added to a database maintained by CoPilot. That database was downloaded by an unauthorized individual, although according to a breach notice issued by CoPilot, the database was not accessible to the general public at any point.

While not explicitly stated in the breach notice, the wording suggests that the individual responsible for the breach was a former employee. CoPilot believes it identified the person responsible and details of its investigation were passed to law enforcement.  CoPilot reports that the law enforcement investigation confirmed CoPilot’s conclusions to be correct.

While it is possible that data were accessed and downloaded with malicious intent, CoPilot does not believe the information was downloaded in order to commit fraud. This also points to an employee rather than a hacker.

The data downloaded was limited to names, genders, addresses, phone numbers, and medical insurance card information, although some individuals’ Social Security numbers were also copied.

Individuals impacted by the breach have been offered credit and identity monitoring services via Kroll for 12 months to protect them against fraudulent use of their information, although CoPilot has told patients it has no reason to believe that any of the downloaded information was misused, nor that it will be disclosed to other individuals.

The security incident came to light when CoPilot started to receive complaints claiming information uploaded to the website could be downloaded. An investigation was immediately initiated and a cybersecurity firm was retained to conduct a forensic investigation.

CoPilot issued a press release on January 18, 2017 announcing the security incident, notified the California Department of Justice on January 19, 2017, and started informing patients on or around the same date.

However, the timing of the breach notices is peculiar. CoPilot discovered the potential breach on December 23, 2015, yet it has taken over a year from discovery of the breach for breach notifications to be issued. CoPilot’s investigation revealed patient data were improperly downloaded in October 2015.

Under Health Insurance Portability and Accountability Act’s Breach Notification Rule, HIPAA-covered entities are required to issue data breach notifications to patients, Office for Civil Rights and the media within 60 days of the discovery of a breach.

The failure to comply with the Breach Notification Rule can result in financial penalties. OCR has recently agreed to settle potential HIPAA Breach Notification Rule violations with Presense Health after breach notifications to patients were delayed. Presense Health was required to pay OCR $475,000 for exceeding the Breach Notification Rule time limit by a month.

Office for Civil Rights investigates all breaches that impact more than 500 individuals to determine whether HIPAA Rules have been violated. Given the recent enforcement activity, action may well be taken against CoPilot for the delayed notifications.

While patients impacted by the incident have only just been notified, prompt action was taken by CoPilot to improve security after the breach was discovered. Those measures included “enhanced verification, enhanced encryption and implementing increased security audit activity.”

The post CoPilot Provider Support Services Alerts 220,000 Patients to Historic ePHI Incident appeared first on HIPAA Journal.