3,600 patients of Children’s Hospital Los Angeles (CHLA) and Children’s Hospital Los Angeles Medical Group (CHLAMG) are being notified of a potential breach of their electronic protected health information following the theft of an unencrypted, password-protected laptop computer.

The laptop was stolen from the locked vehicle of a CHLAMG employee who practices at CHLA. The theft is understood to have occurred on October 18, 2016.

CHLAMG encrypts its laptop computers, and while the investigation into the breach initially indicated the laptop had been encrypted to institutional standards, on December 21, 2016, CHLA determined that there was a possibility that the device had not been encrypted.

Typically, laptops are stolen by thieves for the value of the device, not for data stored on the devices. Laptops are wiped, have software reinstalled, and are sold on.

While it cannot be confirmed that this was the case in this instance, CHLA investigators were able to determine that the laptop computer has not been used to connect to the Internet since it was stolen, suggesting the device was wiped and ePHI is no longer accessible.

A CHLA spokesperson said their IT security systems allow data on laptop computers to be remotely and securely erased. The protocol for doing this has been activated and data on the device will be wiped should the device be used to connect to the Internet.  No evidence has been uncovered to suggest data have been accessed or used inappropriately. CHLA is continuing to work with law enforcement, although to date, the laptop computer has not been recovered.

The data stored on the device included children’s names, addresses, medical record numbers, birthdates, and limited clinical information.

Parents of affected children have been notified of the potential ePHI breach out of an abundance of caution. They have been advised to check Explanation of Benefits statements for medical services that have not been received.

CHLA will be enhancing its encryption levels on all laptop computers used by its physicians to prevent future data breaches of this nature from occurring.

The post Potential ePHI Breach Impacts 3,600 Children’s Hospital Los Angeles Patients appeared first on HIPAA Journal.

Sentara Healthcare is notifying 5,454 patients that some of their electronic protected health information has been accessed by an unauthorized individual.

It is unclear when the cybersecurity incident occurred, although law enforcement informed Sentara Healthcare of the security breach on November 17, 2016.

Sentara Healthcare launched an investigation into the potential data breach in November and determined that the cybersecurity incident was experienced by one of its third party vendors.

Sentara has not disclosed which vendor was attacked, nor whether the incident was an internal breach involving one of the vendor’s employees or if patient data were accessed by a hacker.

The data breach affects vascular and thoracic patients who received medical services at Sentara Healthcare’s Virginia hospitals between 2012 and 2015.

Patients have been notified of the data breach by mail and have been told that highly sensitive protected health information was inappropriately accessed. The information viewed – and potentially copied – by an unauthorized third party includes patients’ names, Social Security numbers, dates of birth, medical record numbers, demographic information, medications prescribed, and details of procedures that were performed at Sentara Healthcare hospitals.

Sentara Healthcare’s Information Security Team is working closely with its vendor and is assisting law enforcement with its criminal investigation. The data breach investigation is ongoing.

Sentara Healthcare has told patients that it continually assesses and strengthens its policies, procedures, and cybersecurity defenses to ensure that patient data is appropriately protected at all times. Patients have been told that those processes will continue and that the third party vendor concerned will be implementing additional controls to enhance its security defenses to prevent similar incidents from occurring in the future.

All patients impacted by the data breach have been offered 12 months of complementary credit monitoring and identity theft protection services through Experian’s ConsumerInfo.com, Inc., and will receive in-depth assistance if their ePHI are discovered to have been used inappropriately.

The post Sentara Healthcare Informs 5,454 Patients of ePHI Breach appeared first on HIPAA Journal.

Wilmington, DE-based healthcare provider Brandywine Pediatrics, P.A. has informed tens of thousands of its patients that some of their protected health information has potentially been accessed by an unknown individual. The security breach involved a computer virus, which was discovered on one of the organization’s file servers.

While it has not been explicitly stated that the virus was ransomware, Brandywine Pediatrics has informed patients that the virus rendered ePHI inaccessible. In order to regain access to files it was necessary to restore files from data backups.

The virus infection was discovered on October 25, 2016, sparking a full investigation. A third-party computer forensics expert was contracted to conduct an investigation. That investigation revealed that a number of practice files containing ePHI had potentially been accessed. Sensitive data in the files included names, addresses, medical information, and health insurance details of patients. Brandywine Pediatrics has confirmed that Social Security numbers, credit card/debit card numbers and financial data were not accessed or exposed at any point.

While data access was possible, no evidence was uncovered to suggest that files had actually been copied by the attacker, and no reports of unauthorized use or misuse have been received as of December 23.

Breach notification letters were mailed to affected patients in late December. At the time, it was unclear exactly how many individuals had been impacted by the breach as this was not stated in the breach notice. The security incident has now been added to the Department of Health and Human Services’ Office for Civil Rights Breach portal. The breach summary indicates 26,873 patients were affected.

Brandywine Pediatrics has advised patients how they can minimize risk and action has been taken to prevent similar malware and ransomware infections in the future. Policies and procedures have been reviewed and updated, and Brandywine Pediatrics is reviewing the security of its systems and improvements will be made, as appropriate.

The post Brandywine Pediatrics Alerts 27,000 to Potential ePHI Breach appeared first on HIPAA Journal.

A routine audit of PHI access logs has revealed that a former employee of Atmore Community Hospital in Alabama accessed the electronic health information of approximately 1,000 patients without authorization over a period of 13 months.

The audit was conducted by Infirmary Management Services, Inc, which manages the hospital. The privacy violations were discovered to have occurred between October 3, 2015 and November 11, 2016.

Fortunately, the information accessed was limited and no financial information, Social Security numbers or medical records were viewed, although the individual did view names of patients, their admission dates, and hospital flowsheets. Data access was permitted in order for the employee to complete work duties, but despite having received training on HIPAA Rules and hospital policies covering patient privacy, the individual viewed patients’ protected health information when there was no legitimate work reason for doing so.

The access is believed to have occurred out of curiosity and no information is thought to have been copied or distributed to any other individuals. Upon discovery of the privacy breach, the employee was placed on immediate leave and was later terminated.

Due to the limited information that was accessed, patients are not believed to face an elevated risk of identity theft and fraud. All affected individuals have been notified of the breach by mail in accordance with Health Insurance Portability and Accountability Act Rules and have been instructed to monitor their finances and statements and to be vigilant for any sign of identity theft and fraud.

Each year there are many instances of healthcare employees violating patient privacy out of curiosity. All too often, these privacy violations are only identified many months after data have started to be inappropriately accessed. While it is not possible to eliminate the risk of privacy violations such as this entirely, healthcare providers can ensure that inappropriate PHI access is identified promptly by conducting regular audits of data access logs.

The post Atmore Community Hospital Employee Inappropriately Accessed 1,000 Patient Records appeared first on HIPAA Journal.