SkinCure Oncology has notified 13,434 patients about an email attack that occurred in June 2023, and the Wisconsin Department of Health Services has announced a breach of the personal information of 19,150 Medicaid recipients.

SkinCure Oncology

SkinCure Oncology in Burr Ridge, IL, has issued individual notifications to 13,434 patients whose protected health information was compromised in an email breach that occurred more than a year ago. According to the substitute breach notice, the investigation confirmed that multiple email accounts were accessed by an unauthorized third party between June 23 and June 25, 2023.

A comprehensive review was conducted to identify the files in the email accounts, and on December 6, 2023, it was confirmed that protected health information was present in emails and email attachments. SkinCure Oncology believes files in those email accounts were viewed and potentially obtained in the attack. The exposed information varied from individual to individual and may have included names, birth dates, medical record numbers, medical histories, and health insurance information. A limited number of patients had their Social Security numbers, driver’s license numbers, financial account information, and/or credit card information exposed.

The delay in issuing individual notifications was due to the time it took for SkinCure Oncology and its practice partners to locate up-to-date address information. The substitute breach notice makes no mention of complimentary credit monitoring and identity theft protection services, only that patients should be vigilant against identity theft and fraud. Further information can be contained by calling SkinCure Oncology’s helpline – (866) 528-8844. The helpline is manned Monday to Friday from 8:00 a.m. to  5:30 p.m. Central Time.

Wisconsin Department of Health Services

Wisconsin Department of Health Services has reported a breach of the protected health information of up to 19,150 Medicaid recipients. The breach occurred at one of its partner organizations, Disability Rights Wisconsin, which discovered an unauthorized third party had gained access to an employee email account. It is unclear from the announcement when the breach occurred and when it was discovered.

Notification letters were sent to the affected individuals on June 21, 2024, and they were advised about the data that was exposed. Complimentary credit monitoring services have been offered to the affected individuals for 12 months and a helpline – 888-733-3814 – has been set up for individuals seeking further information. The helpline is manned Monday to Friday, from 8:00 a.m. to 8 p.m. Central Time.

The post Email Breaches Reported by SkinCure Oncology & the Wisconsin Department of Health Services appeared first on The HIPAA Journal.

A cyberattack on Texas Retina Associates has affected more than 312,000 patients, Human Technology Inc., has confirmed that patient data has been compromised in a cyberattack, and the Monti ransomware group has claimed responsibility for a cyberattack on Wayne Memorial Hospital.

Texas Retina Associates Cyberattack Affects 312,000 Patients

Texas Retina Associates, the largest ophthalmology practice in Texas, has announced that there has been unauthorized access to its internal systems and the potential theft of sensitive patient data. Suspicious network activity was identified on March 27, 2024, and third-party cybersecurity specialists were engaged to investigate the activity. They confirmed that an unauthorized actor gained access to its network on October 8, 2023, and maintained access until the breach was detected.

Texas Retina Associates said it is unaware of any misuse of patient data and is issuing notifications “out of an abundance of caution” as files have been exposed that contained patient data. The file review confirmed that the exposed data included first and last name, address, phone number, email address, birth date, gender, Social Security number, medical record number, clinical information, prescription information, medical information, health information, and health insurance information.

The breach has recently been reported to the HHS’ Office for Civil Rights as affecting up to 312,867 current and former patients. Texas Retina Associates has confirmed that its systems have been secured, additional cybersecurity safeguards have been implemented, cybersecurity policies and procedures have been enhanced, and additional cybersecurity training has been provided to its workforce. A helpline has been established for individuals to obtain further information about the breach (888-498-3901) The helpline is manned from 8 a.m. to 8 p.m. Central Time.  The substitute breach notice on the Texas Retina Associates website makes no mention of complimentary credit monitoring or identity protection services being offered.

Human Technology Inc.

The Jackson, TN-based prosthetics and orthotics company, Human Technology Inc., and its affiliates Greer Orthotics & Prosthetics, Murphy’s Orthopedic & Footcare, and Hi-Tech Prosthetics & Orthotics have been affected by a data security incident that was detected on March 15, 2024.

An internal investigation was launched to identify the source of anomalous network activity and a digital forensics firm was engaged to assist with the investigation. The investigation was completed on or around May 31, 2024, and confirmed that an unauthorized actor gained access to a computer system used by Human Technology and its affiliates and potentially viewed or obtained patient data. The exposed data included names, addresses, dates of birth, medical information, health insurance information, Social Security numbers, driver’s license numbers, passport numbers, payment card numbers/expiry dates, account numbers, routing numbers, and tax IDs.

Notification letters were mailed to the affected individuals on June 28, 2024, and complimentary credit monitoring and identity theft protection services have been offered to the affected individuals. Human Technology said it is unaware of any misuse of the affected data. To improve security and reduce the risk of similar incidents in the future, Human Technology has implemented additional safeguards, including EDR monitoring. A helpline has been established for individuals seeking further information on the breach ((866)-528-4805). The helpline is manned from 8.00 a.m. to 5.30 p.m. Central Time.

The incident is not yet shown on the HHS’ Office for Civil Rights website so it is currently unclear how many individuals have been affected.

Ransomware Group Claims Responsibility for Attack on Wayne Memorial Hospital

The Monti ransomware group has claimed responsibility for a cyberattack on Wayne Memorial Hospital, an 11-bed non-profit hospital in Honesdale, PA. The hospital has yet to announce any cyberattack or data breach. The hospital has been added to the Monti group’s data leak site, but no data is currently listed for download. The group says it has given the hospital until July 8, 2024, to pay the ransom demand and will leak the stolen data if payment is not made.

The post Texas Retina Associates Cyberattack Affects 312,000 Patients appeared first on The HIPAA Journal.

Marlton, NJ-based Continuum Health Alliance has recently confirmed that it has experienced a security incident that exposed the data of 377,119 patients of its client, Consensus Medical Group, a physician-owned medical group in Evesham, NJ. Continuum identified unauthorized activity within its network on October 19, 2023, and after taking steps to secure its systems, third-party cybersecurity specialists were engaged to identify the suspicious activity. The forensic investigation confirmed that an unauthorized third party had gained access to some of its systems between October 18 and October 19, and acquired certain files.

On February 16, 2024, Continuum announced on its website that it was investigating the incident while the investigation was ongoing. The file review was completed on March 8, 2024, when it was confirmed that the exposed data included patients’ names and Social Security numbers. Continuum then worked to verify the information and obtain up-to-date address information, and notification letters were mailed on April 29, 2024.

Continuum has implemented additional safeguards to prevent further security incidents and has provided additional training to its workforce. The affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months.

Guardant Health Discovers Online Exposure of Patient Data

Guardant Health, a medical laboratory in Redwood City, CA, that performs cancer screening tests on samples provided by physicians and hospitals, has recently notified patients of some of its clients that their protected health information has been exposed online. Guardant Health did not state in its notification letters when it discovered the data exposure, only that an employee inadvertently uploaded a file containing patient data to an online platform in October 2020. Guardant Health immediately removed the file when the error was discovered, and on March 4, 2024, it was confirmed that unidentified third parties downloaded the file between September 8, 2023, and February 28, 2024.

The protected health information in the file varied from patient to patient and included some or all of the following: name, age, medical record and identification numbers, and medical information such as treatment information, dates of treatment, and test results. No financial information or Social Security numbers were present in the file. Guardant Health said it has enhanced its technical controls and has provided further employee training to prevent similar incidents in the future. The breach has been reported to regulators but is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Continuum Health Alliance Data Breach Affects 377,000 Consensus Medical Group Patients appeared first on HIPAA Journal.

The Cypress, CA-based revenue cycle management company, Designed Receivable Solutions (DRS), has recently confirmed the details of a data breach that was reported to the HHS’ Office for Civil Rights on March 23, 2024, as involving the protected health information of 129,584 individuals, and the Maine Attorney General as affecting 498,686 individuals.

On January 22, 2024, DRS identified suspicious activity within its network. Third-party cybersecurity specialists were engaged to investigate the incident and determine the cause of the activity. The investigation confirmed that an unauthorized actor accessed its systems and viewed and exfiltrated files from its systems. On March 8, 2024, after a time-consuming and detailed review of the files, DRS confirmed that they contained the personal and protected health information of current and former patients of its healthcare clients.

Following that determination, DRS has been working with the affected clients to review and verify the affected information and obtain up-to-date contact information to allow notification letters to be issued.  DRS said the types of data involved varied from individual to individual and may have included names, addresses, dates of birth, health insurance information, dates of service, and Social Security numbers. DRS has reviewed its policies and procedures related to data privacy and is taking steps to reduce the risk of a similar incident in the future and has offered the affected individuals complimentary credit monitoring services.

As OCR recently confirmed in a website Q&A regarding breach notification letters, HIPAA-covered entities are ultimately responsible for ensuring notification letters are sent to the affected individuals when there is a data breach at a business associate, but the covered entity may delegate the responsibility of providing individual notices to the business associate.

DRS is issuing notification letters on behalf of the following covered entity clients:

• Air Methods
• AMG Healthcare Management Services
• CAN Emergency Physicians
• Cedars-Sinai Medical Center
• CHA Hollywood Presbyterian Medical Center, L.P.
• Core Orthopaedics Medical Center
• GEM Physicians Group
• Marshall Medical Center
• OptumCare Management, LLC
• Redlands Community Hospital
• Ridgecrest Regional Hospital
• South Coast ER Medical Group
• Southland Medical Corporation
• Springhill Emergency Physicians
• Sycamore Physicians, LLC
• USC Arcadia Hospital (formerly Methodist Hospital of Southern California)
• Valkyrie Clinical Trials, Inc.

The post Almost 500,000 Individuals Affected by Designed Receivable Solutions Data Breach appeared first on HIPAA Journal.

The medical device manufacturer Livanova, the Massachusetts community behavioral health center Aspire Health Alliance, and Santa Rosa Behavioral Healthcare Hospital in California have experienced ransomware attacks that exposed patient data.

Livanova, London, UK

Livanova, a UK-headquartered medical device manufacturer specializing in cardiac surgery and neuromodulation devices, has suffered a ransomware attack that disrupted portions of its IT systems. The ransomware attack was discovered on November 19, 2023, and the forensic investigation confirmed that hackers gained access to its network on October 26, 2023. The LockBit ransomware group claimed responsibility for the attack.

Livanova announced in a SEC filing in November that it was dealing with a cyberattack; however, it was initially unclear to what extent patient data was involved. On April 10, 2024, Livanova confirmed that the personal and protected health information of U.S. patients had been exfiltrated from its systems in the attack. In an April 25, 2024, announcement, Livanova said the investigation is ongoing however it has been determined that information such as names, contact information, dates of birth, Social Security numbers, health insurance information, and medical information such as diagnoses, conditions, treatment information, prescription information, medical record number, device serial numbers, and physician names were involved.

The affected individuals have been advised to monitor their credit reports and account statements and to be alert to unsolicited communications involving personal information. Livnova has arranged for complimentary identity protection and credit monitoring services to be provided to the affected U.S. patients. It is currently unclear how many individuals have been affected. In a February 2024 earnings call, the company confirmed that the company had incurred costs of around $2.6 million in Q4, 2023, as a result of the attack.

Aspire Health Alliance, Massachusetts

Aspire Health Alliance, a state-designated community behavioral health center with facilities in Quincy, Braintree, and Marshfield in Massachusetts, has notified 17,490 individuals about a cyberattack that was detected on September 13, 2023. Suspicious activity was identified within its computer network and a third-party forensic investigation confirmed that its systems had been accessed by an unauthorized third party that acquired certain files and data stored on its network.

A comprehensive review was conducted to determine the types of data involved, and that process was completed on February 26, 2024, when it was confirmed that personal and protected health information was involved. The types of data varied from individual to individual and may have included names, other personal identifiers, and Social Security numbers. While data was exposed or acquired, no reports have been received to indicate any patient data has been misused. Complimentary credit monitoring and identity protection services have been offered to individuals whose Social Security numbers were impacted, and additional security measures have been implemented to reduce the risk of a similar incident occurring in the future.

Santa Rosa Behavioral Healthcare Hospital, California

Santa Rosa Behavioral Healthcare Hospital, part of the Northern California Behavioral Health System (NCBHS), has fallen victim to a cyberattack that disrupted some of its IT systems. The attack was detected on January 28, 2024, and a third-party forensic investigation confirmed that an unauthorized third party accessed its network between January 27, 2024, and January 28, 2024. During that time, files containing patient data were accessed or acquired.

The file review confirmed that the following types of information had been exposed or stolen: names, dates of birth, medical record numbers, services received, dates of services, treating physician, and for some patients, Social Security numbers and/or driver’s license numbers. Affected patients have been advised to monitor the statements they receive from their healthcare providers and health insurers and report any services they haven’t received. Individuals whose Social Security or driver’s license numbers were involved have been offered complimentary identity theft protection services. The incident has been reported to regulators but is not yet shown on the Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Patient Data Stolen from Livanova in October 2023 Ransomware Attack appeared first on HIPAA Journal.

A Portland, ME-based accounting and consulting firm has recently reported a data breach to the Maine Attorney General that involved the personal information of 1,107,354 individuals. Berry, Dunn, McNeil & Parker, LLC (BerryDunn) provides health data analytics services to healthcare providers, health insurers, and government regulatory and healthcare policy agencies and its clients provide BerryDunn with personal and health data to allow the firm to perform its contracted services.

BerryDunn’s Health Analytics Practice Group (HAPG) contracted with a managed service provider (MSP) called Reliable Networks of Maine, LLC (RMN), which manages systems on behalf of HAPG. On September 14, 2023, RMN notified HAPG that it had identified suspicious activity on its network, including in the systems it manages for HAPG. BerryDunn immediately initiated its incident response protocols and brought in third-party cybersecurity experts to investigate to determine the extent to which client data was involved.

The investigation confirmed that a threat actor gained access to the RMN network and used the vendor’s privileged access to steal data from the HAPG systems the MSP managed. A vendor was engaged to conduct a review of the affected files, and that process was completed on April 2, 2024. The information exposed or stolen in the incident included names, addresses, dates of birth, Social Security numbers, health insurance policy numbers, Medicare or Medicaid numbers, state or governmental ID numbers, passport numbers, and medical information. Notification letters were mailed to the affected individuals on April 25, 2024, and complimentary credit monitoring and identity theft protection services have been offered to the affected individuals. Those services include a $1 million identity theft reimbursement policy.

It is unclear how many of BerryDunn clients have been affected. BerryDunn has confirmed that it has decommissioned all systems under the control of RMN, migrated all HAPG data to secure internal BerryDunn servers, and said those servers are continuously monitored for unauthorized access under its cybersecurity program.

The post Health Data Analytics Firm Reports 1.1-Million Record MSP Data Breach appeared first on HIPAA Journal.