UCLA Health Medical Center in Los Angeles is conducting an internal investigation into a potential HIPAA breach that occurred around Thanksgiving weekend.

On November 21, 2016, Kanye West checked in to the hospital and stayed for 8 days. During his stay at the hospital, a number of nurses and other medical staff allegedly accessed his medical records without authorization. It would appear than the employees could not resist the temptation to snoop on his medical records.

The unauthorized viewing of celebrities’ medical records is a problem for hospitals, in particular medical facilities in Los Angeles and New York. In recent years, there have been a number of incidences of the privacy of celebrities being violated by curious hospital employees. Numerous employees have been found to have accessed the records of celebrities out of personal curiosity, although in many cases, inside information has been sold to gossip websites and tabloids.

A former employee of UCLA Medical Center plead guilty to accessing and selling the medical records of Farrah Fawcett and Brittney Spears to the National Enquirer in 2008, although an investigation into celebrity health record breaches at the time revealed that more than 120 workers had improperly accessed the celebrities’ health records.

Under Health Insurance Portability and Accountability Rules, HIPAA-covered entities should maintain logs to ensure the improper accessing of PHI can be identified. UCLA Medical Center logs access attempts and can check those logs to determine which staff members viewed a particular patient’s health records and determine whether there was any legitimate reason for access.

If improper access is determined to have occurred, employees will be disciplined accordingly. All too often, improper access results in termination.

While UCLA Medical Center has not confirmed whether any employees have been terminated as a result of accessing Kanye West’s medical records, some online sources claim that dozens of staff at the hospital are facing disciplinary action and that several staff members have already been fired.

The post UCLA Medical Center Investigates Potential Breach of Kanye West’s Medical Records appeared first on HIPAA Journal.

Kaiser Permanente is alerting certain members to the potential disclosure of a limited amount of their personal information to other KP members after a glitch was discovered in the company’s online ‘Estimates’ tool.

On November 16, 2016, Kaiser Permanente updated the Estimates tool on the kp.org website; however, an error occurred during the update that potentially resulted in members’ name, address, age, copay information, deductible payments from 2016, and out of pocket expenses from 2016 being displayed to another user of the tool.

Individuals potentially affected by the error visited the website and used the tool from the date that the update was applied until November 28, 2016 when the error was discovered and corrected.

Kaiser Permanente has informed affected patients that there was only a small chance that their information was viewed by another person. At no point were Social Security numbers, claims information, or banking details exposed.

The error did not result in the mass disclosure of PHI to other members. In each case, an individual who used the tool may have had their data displayed to the next person who used the tool.

Kaiser Permanente conducts extensive testing of its online systems following any upgrade. Members have now been notified of the incident by mail and told “there is always the rare chance that an error can go undetected until an update is live.”

However, this will be bad news for Kaiser Permanente as it is the second website error to be discovered in just a few weeks. Certain members were impacted by a website error caused during a kp.org site upgrade in October. In that instance, the upgrade was made to improve webpage speed and the error was identified and corrected within 24 hours.

Members affected by the latest breach have been urged to review their Explanation of Benefits statements and to report any irregularities, although due to the type information exposed and the speed of detection and correction of the error, Kaiser Permanente says the privacy risk is ‘limited’.

The post Website Glitch Exposes Personal Information of KP Members appeared first on HIPAA Journal.

An unplugged security vulnerability at a business associate of Community Health Plan of Washington has resulted in the exposure of the protected health information (PHI) of almost 400,000 plan members.

Community Health Plan of Washington is now in the process of notifying all affected members that highly sensitive information including names, addresses, dates of birth, Social Security numbers, and health insurance information have been exposed and compromised.

The data breach was confirmed on November 30, 2016, although Community Health Plan of Washington first became aware of a potential breach on November 7 after a tip-off was received.

Staff at the health plan picked up a voicemail message from an individual who reported a vulnerability that had been discovered in the network of one of the health plan’s business associates. That vulnerability could be exploited to gain access to members’ data.

Community Health Plan of Washington followed up on the tip-off and contacted the firm in question, which is a subsidiary of NTT Data. The firm provides technical services to the health plan. Rapid action was then taken by the firm to confirm that the vulnerability existed and then correct the flaw to prevent data access.

A computer forensics investigator was hired to conduct a thorough analysis of the network and confirmed that the vulnerability had been exploited and that an unauthorized individual had accessed plan members’ PHI. It is unclear whether that individual was the same person that reported the vulnerability. At the time of writing, plan members’ data are not believed to have been used inappropriately. No reports of data misuse have been received by the health plan or its business associate.

Notification letters to affected plan members were delayed until the investigation into the data breach was completed and while the health plan set put the logistics in place to deal with the breach. A toll-free helpline for members has now been set up and credit monitoring services have been arranged.

According to a report in the Seattle Times, each member will receive an individual notification letter with an identification number that can be used to register for credit monitoring services with Kroll.

381,534 members of the health plan, which provides insurance through Medicaid throughout Washington state, have been affected by the breach.

The post Community Health Plan of Washington Announces 400,000-Record Data Breach appeared first on HIPAA Journal.

A Florida man has been sentenced to serve four years in federal jail for selling medical records obtained from the medical device firm, Rotech Healthcare.

Vickie Lorenzo Bryant, 39, from Plant City, FL made contact with a government informant in May 2016 and offered to sell personally identifiable information of 957 individuals who had received medical devices from Rotech Healthcare.

This was not the first time Bryant had attempted to sell stolen data to identity thieves and fraudsters. The confidential informant had previously purchased other individuals’ data from Bryant and had used the information to obtain Florida driver’s licenses, make counterfeit credit cards, and purchase mobile phones in the victims’ names.

Bryant met with the informant on two occasions in June 2016 and sold the data of 957 different individuals. Bryant asked to be paid $15,000 for the batch of data or $15 per identity.

Around 1,000 documents were handed over to law enforcement and were found to contain a range of personal and medical information about the victims, including names, addresses, Social Security numbers and dates of birth.  Law enforcement contacted those individuals and all confirmed that they had all previously received respiratory or sleep apnea devices from Rotech Healthcare in the past. Rotech Healthcare was alerted to the data breach by law enforcement on June 13, 2016 and all patients were notified of the incident shortly thereafter.

Bryant was arrested and pleaded guilty to access device fraud and aggravated identity theft on August 23, 2016 and was sentenced by U.S. District Judge Charlene Edwards Honeywell on Tuesday last week.

Bryant did not personally steal the data from Rotech Healthcare. Two co-conspirators who were employed at Rotech allegedly obtained the data and sold it to Bryant. Fontella James and Sharmekia Young were indicted on September 29, 2016 and have been charged with conspiracy, computer intrusion, and crimes related to identity theft and are awaiting trial.

The post Identity Thief Sentenced to 4 Years for Selling Stolen Rotech Healthcare Data appeared first on HIPAA Journal.

More than 1,000 current and former patients of Oak Cliff Orthopaedic Associates have been notified that unauthorized individuals may have viewed some of their protected health information.

Boxes of paper business records and other items were stolen from an off-site storage facility used by the Dallas orthopedic firm. It is currently unclear when the theft occurred and how long the thieves had access to the information, although the theft was discovered on October 17, 2016.

The documents contained patients’ names, addresses, and medical record numbers, although an investigation revealed that some of the documents also contained certain patients’ credit card numbers, Social Security numbers, and banking information.  Patients affected by the incident had received medical services from Oak Cliff Orthopaedic Associates between 2006 and 2007.

The Lewisville Police Department did manage to recover the stolen files and they have now been returned to Oak Cliff Orthopaedic Associates and are now secured. The stolen items were found in a hotel room, but it is unclear whether the thieves have been identified or apprehended. All other items not taken by the thieves have since been removed from the storage facility and have now been secured.

Since financial data have potentially been viewed and copied by the thieves, Oak Cliff Orthopaedic Associates notified relevant financial institutions of the risk of fraudulent activity on the affected individuals’ accounts. Patients impacted by the incident have now been notified mail and a press release has been issued in accordance with Health Insurance Portability and Accountability Act Rules.

Oak Cliff Orthopaedic Associates has not received any reports to suggest any of the stolen information has been used inappropriately, although it is possible that patient data were viewed by the thieves. As a precaution against identity theft and fraud, all 1,057 patients affected by the incident have been offered one year of identity theft protection services without charge.

The post Oak Cliff Orthopaedic Associates Alerts Patients to Potential PHI Breach appeared first on HIPAA Journal.