Harvard Pilgrim Health Care has confirmed that the information of 2,632,275 individuals was compromised in an April 2023 ransomware attack, increasing the previous total by 81,353. In updated notices submitted to the Attorneys General in California and Maine this month, Harvard Pilgrim Health Care explained that the attack was detected on April 17, 2023, and action was immediately taken to contain the threat and prevent further unauthorized access to its systems. Law enforcement and regulators were notified, and third-party cybersecurity experts were engaged to assist with its investigation and remediation efforts.

Harvard Pilgrim Health Care said the cybercriminal group behind the attack exfiltrated data from its systems between March 28, 2023, and April 17, 2023. The systems accessed by the attackers were used to service members, accounts, brokers, and providers, which contained names, Social Security numbers, and financial information. Harvard Pilgrim Health Care started notifying the affected individuals on May 23, 2023 and disclosed the breach to media organizations serving all 50 states. On June 15, individual notification letters started to be mailed to the affected individuals. As the investigation progressed it became clear that other individuals had been affected.  Harvard Pilgrim Health Care has offered complimentary credit monitoring and identity theft protection services to the affected individuals and has implemented additional cybersecurity safeguards to prevent similar breaches in the future.

Coleman Professional Services Inc. Reports Breach of Employee Email Accounts

Coleman Professional Services, Inc., an Ohio-based provider of behavioral health services, has reported a breach of its email environment. On December 14, 2023, Coleman learned that an unauthorized third party had gained access to several employee email accounts. The forensic investigation confirmed the accounts were accessed by an unauthorized third party between September 18, 2023, and October 31, 2023.

The forensic investigation could not confirm whether any patient data was viewed or acquired, but the review of the affected accounts confirmed that they contained the protected health information of 51,889 individuals. The types of information exposed varied from individual to individual and may have included first and last names, dates of birth, Social Security numbers, driver’s license numbers, financial information, and, in some cases, health information. Identity theft protection services have been offered to the affected individuals. Coleman has also taken additional steps to prevent unauthorized individuals from accessing its employee email accounts.

North Hill Communities Report Cyberattack and Data Breach

North Hill, including North Hill Communities, Inc., North Hill Home Health Care, Inc., North Hill Needham, Inc., Connected for Life, Inc., and the North Hill Employee Dental Plan, has confirmed that the personal and protected health information of up to 4,798 individuals was potentially compromised in a December 2023 cyberattack.

The attack was detected on December 26, 2023, and the forensic investigation confirmed that its network had been compromised by an unauthorized third party on December 19, 2023. North Hill said it was not possible to determine whether personal or protected health information was accessed or acquired but did determine that the compromised parts of its network contained sensitive data. The exposed data included names in combination with one or more of the following: date of birth, date of death (if applicable), address, Social Security number, phone number, admission date, health insurance information, medical record number, treatment dates, financial account/bank account number, driver’s license number, claims information, and medical information.

North Hill started notifying the affected individuals on February 14, 2023 and is covering the cost of Single Bureau Credit Monitoring/Single Bureau Credit. Additional security detection and monitoring solutions are being implemented to help prevent similar occurrences in the future.

Advarra Inc. Reports Email Account Breach

Advarra Inc., a provider of integrated research compliance solutions, has reported a breach of the personal and protected health information of 4,656 individuals. On October 26, 2023, Advarra identified suspicious activity in an employee email account. The investigation confirmed that a single account was breached on October 25, 2023, and company and personal information in the account was acquired by an unauthorized third party. That information included names and Social Security numbers. Advarra is unaware of any actual or attempted misuse of data but has offered the affected individuals complimentary credit monitoring and identity theft protection services as a precaution.

The post Harvard Pilgrim Health Care Ransomware Victim Count Rises to 2.6 Million appeared first on HIPAA Journal.

Data breaches have recently been reported by the Hampton-Newport News Community Services Board, Marywood Nursing Care Center, Health Alliance, United Regional Health Care System, Nabholz Construction, and J.D. Gilmour & Co.

Hampton-Newport News Community Services Board

The Hampton-Newport News Community Services Board, a Virginia-based provider of behavioral health and intellectual and developmental disability services, has notified 44,312 individuals that some of their protected health information was compromised in a recent ransomware attack. Technical disruptions were experienced on November 12, 2023, and it soon became clear that the disruption was due to the use of ransomware. Third-party cybersecurity experts were engaged to assist with the investigation and remediation, and they determined that the attackers gained access to its network on September 26, 2023.

A review was conducted of all files that could have been accessed which confirmed that patient data had been exposed.  The exposed data varied from patient to patient and may have included names in combination with Social Security numbers, addresses, ZIP codes, driver’s license numbers, dates of birth, clinical information such as diagnosis/conditions, lab results, medications or other treatment information, claims information and insurance information. The Hampton-Newport News Community Services Board was unable to confirm if the above data was accessed or stolen in the attack. Credit monitoring and identity restoration services have been offered to the affected individuals.

Marywood Nursing Care Center

Marian Village Corporation, doing business as Marywood Nursing Care Center in Massachusetts, experienced a security breach that involved the protected health information of 6,178 individuals. The breach notification sent to the Massachusetts Attorney General does not state when the breach was detected or when it occurred, only that an unauthorized individual accessed its network and potentially stole files that contained names, claim information, and addresses. No other information was compromised in the attack. The affected individuals have been offered complimentary access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge. Marywood said it has deployed additional monitoring tools and will continue to review and enhance the security of its systems.

Health Alliance

Health Alliance in Illinois has recently confirmed that the protected health information of 6,900 of its members was exposed in a data breach at a subcontractor of one of its business associates.  Health Alliance Contracted with OnTrak, which used the subcontractor Keenan. On August 27, 2023, Keenan discovered the unauthorized access and disconnected its network to contain the incident. The forensic investigation confirmed that an unauthorized third party had gained access to records containing health plan members’ data. Keenan notified Health Alliance about the breach on December 20, 2023, and provided a list of the affected members on January 10, 2024.

Health Alliance then reviewed and matched the list to the records of its members and notification letters have now been sent. Health Alliance said the following information was compromised in the incident: name, address, member number, date of birth, health coverage information, and, in some cases, Social Security number. Keenan has offered the affected individuals a 24-month membership to the Experian IdentityWorksSM Credit 3B service.

Nabholz Construction

Nabholz Construction, a provider of construction-related services in Arkansas, has been affected by a data breach at Cadence Bank, that exposed the protected health information of 5,326 members of its Corporation Employee Welfare Health Plan. Cadence Bank informed Nabholz on November 29, 2023, that data had been exposed in a cyberattack that exploited a zero-day vulnerability in Progress Software’s MOVEit Transfer solution. Progress Software issued a patch to fix the vulnerability on May 31, 2023; however, Cadence Bank determined that the vulnerability had been exploited between May 28, and May 31, 2023. The data compromised in the attack included names, Social Security numbers, dates of birth, addresses, medical information such as treatment information, provider names, medications, and health insurance information.

J.D. Gilmour & Co., Inc.

J.D. Gilmour & Co., Inc., a Glendale, CA-based insurance agency, discovered unauthorized access to its email environment on June 29, 2023. Third-party cybersecurity experts were engaged and conducted a forensic investigation of its entire email tenant, which confirmed there had been unauthorized access to a single employee email account. The review of the email account determined on October 27, 2023, that the protected health information of 2,481 individuals had been exposed. On December 21, 2023, J.D. Gilmour & Co. obtained the authorization to mail notification letters from the affected client. The affected individuals have been offered Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no cost.

United Regional Health Care System

United Regional Health Care System has recently reported a hacking-related data breach to the HHS’ Office for Civil Rights that affected 36,900 patients. There is currently no mention of a data breach on the website of the Wichita Falls, TX-based health system but the breach notification submitted to the Texas Attorney General states the breach occurred on May 30, 2023, and involved names, dates of birth, medical information, and insurance information.

The post February 14, 2024 Healthcare Data Breach Round-Up appeared first on HIPAA Journal.

Azura Vascular Care, a Pennsylvania-based operator of 70 outpatient vascular centers and ambulatory surgery centers in 25 states and Puerto Rico, notified the HHS’ Office for Civil Rights last month about a cybersecurity incident involving the protected health information of 348,000 patients.

The incident was detected on November 9, 2023. Cybersecurity experts were engaged to assist with the investigation, which confirmed that unauthorized individuals accessed certain systems on or before September 27, 2023, and encrypted certain files. On November 15, 2023, it was confirmed that some of the files that were available to the hackers contained patient data such as names, mailing addresses, dates of birth, and other demographic and contact information, including emergency contact information, Social Security numbers, insurance information, diagnosis and treatment information, and other information from medical or billing records.

Some guarantor information was also exposed, including names, mailing addresses, telephone numbers, dates of birth, Social Security Numbers, and email addresses. Azura Vascular Care said individuals who had sensitive information exposed such as Social Security numbers have been offered complimentary identity protection, credit monitoring, and fraud resolution services.

Covenant Care California Assessing Scope of Cyberattack

Covenant Care California, LLC, which operates skilled nursing facilities and home health agencies throughout California and Nevada, has confirmed there has been unauthorized access to files containing the personal and protected health information of patients and other individuals. The cyberattack was detected on November 14, 2023, and while the investigation is ongoing, it has been determined that files were removed from its network between November 12 and November 14.

The incident has affected current and former patients, prospective patient referrals, and responsible parties of patients who received services from a facility or agency operated by Covenant Care, including rehabilitation services provided through a company called AFFIRMA and home health services provided under the names Focus Health, Elevate Home Health, Choice Home Health Care, and San Diego Home Health.

The list of affected individuals has yet to be finalized, but Covenant Care California has confirmed that the incident involved the following information: name, date of birth, medical information, and/or health insurance information, including diagnosis or treatment information and/or claims and billing information. For some individuals, the information may include also Social Security number, financial account or credit/debit card numbers, driver’s license or state/federal identification number, and/or other personal information.

The breach has been reported to the HHS’ Office for Civil Rights with an interim total of 501 individuals, which will be updated when the investigation concludes. Affected individuals are being offered credit monitoring and identity theft restoration services at no cost.

Cooper Aerobics Announces 124K-Record Data Breach

Cooper Aerobics, on behalf of Cooper Clinic, Cooper Medical Imaging, and Cooper Aerobics Enterprises in Texas, has notified 124,341 individuals that some of their protected health information was exposed in a cyberattack in early 2023. It is not clear from the notification letters when the intrusion occurred. After a comprehensive investigation and file review, Cooper Aerobics learned on December 8, 2023, that files containing the personal and protected health information of patients were potentially removed from its network on February 3, 2023.

Patients have been notified that the following information was potentially involved: name, address, phone number, email address, date of birth, credit or debit card number (including expiration date, and financial account and routing number), tax identification number, driver’s license or government identification, passport number, username and password, Social Security number, and health information (including medical record/patient account number, prescription information, medical provider, and medical procedures), and health insurance information.

Cooper Aerobics started notifying the affected individuals on January 5, 2024 and said it continually evaluates and modifies its practices and internal controls to protect against unauthorized access and will continue to do so.

6,000 Individuals Impacted by Ransomware Attack on Colorado Ophthalmology Associates

Colorado Ophthalmology Associates (COA) has recently disclosed a ransomware attack that was discovered on November 14, 2023. Data exfiltration is common in ransomware attacks, but no evidence of data theft was identified during the forensic investigation. COA said that the attack involved automated encryption and resulted in the loss of electronic medical record files for patient visits or exams conducted between April 10, 2023, and November 14, 2023.

The forensic investigation confirmed that the intrusion began as early as October 4, 2023, and ended on November 14, 2023. The types of information exposed in the attack were limited to names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, insurance information, dates of service, types of services, diagnoses, conditions, prescriptions, test results, medications, and other treatment information. The incident has been reported to the HHS’ Office for Civil Rights as affecting up to 6,020 individuals.

The post Azura Vascular Care Reports Data Breach Affecting 348,000 Patients appeared first on HIPAA Journal.

Approximately 462,000 individuals who enrolled in health plans through the Hawaii Medical Service Association (HMSA) have been affected by a data breach at the St. Louis, MO-based business services provider Navvis & Company. Navvis & Company detected unauthorized activity within its systems on July 25, 2023, and the forensic investigation confirmed that an unauthorized third party had access to its systems between July 12, 2023, and July 25, 2023, and exfiltrated sensitive information.

Navvis & Company mailed notification letters to the affected health plan enrollees last month. The information exposed in the incident included names, dates of birth, health plan information, medical treatment information, medical record numbers, patient account numbers, case identification numbers, provider and doctor information, and health record information. The affected individuals have been offered complimentary credit monitoring and identity theft protection services.

Navvis & Company reported the breach to OCR as affecting 917 individuals, with the affected clients mostly choosing to report the breach themselves. As such the total number of individuals affected is not known. Other affected clients included SSM Health.

Atlanta Women’s Health Group Notifies 30,000 Patients About April 2023 Cyberattack

Atlanta Women’s Health Group has notified approximately 30,000 patients that their protected health information was stolen in a cyberattack that was detected on April 12, 2023. Third-party cybersecurity experts were engaged to investigate the extent of the breach and an extensive data mining exercise was conducted to determine the individuals affected and the types of data involved.

Atlanta Women’s Health Group said for the majority of patients, the exposed data was limited to names, dates of birth, patient ID numbers, and other information that may be contained in medical records. It was not possible to tell which specific types of information were accessed or acquired. The review was time-intensive, hence the delay in issuing notification letters. Following the attack, Atlanta Women’s Health Group worked with outside security consultants to implement additional cybersecurity measures to prevent further attacks. While data theft occurred, Atlanta Women’s Health Group said it is unaware of any misuse of patient data.

Coastal Hospice & Palliative Care Confirmed PHI Exposure in July Cyberattack

Coastal Hospice & Palliative Care in Salisbury, MD, has confirmed that the protected health information of 29,100 individuals was potentially compromised in a July 2023 cyberattack. The attack was detected on July 24, 2023, when its network was disrupted. Cybersecurity experts were engaged to investigate the incident and assist with the recovery process.

The review of the files on the affected part of the network was completed on November 20, 2023, and confirmed that the following information had been exposed and was potentially obtained by the attackers: name, Social Security number, date of birth, medical diagnosis information, individual health insurance policy number, physician or medical facility information, medical condition or treatment information and patient account number. Coastal Hospice & Palliative Care said the incident was reported to the Federal Bureau of Investigation and steps have been taken to improve security to prevent similar incidents in the future.

The post 462,000 Hawaiians Affected by Data Breach at Navvis & Company appeared first on HIPAA Journal.

Des Moines Orthopaedic Surgeons (DMOS) in Iowa has recently notified 307,864 current and former patients that some of their protected health information (PHI) was exposed in a cyberattack almost a year ago. DMOS explained that the incident occurred on or around February 17, 2023, and allowed an unauthorized third party to access and/or remove files containing the PHI of DMOS patients. DMOS said the breach was due to the failure of one of its vendors.

DMOS said it immediately contained the threat and engaged third-party cybersecurity experts to investigate the incident to determine the extent of compromise. According to the notification letters, “DMOS devoted considerable time and effort to assessing the extent and scope of the incident and to determine what information may have been accessible to the unauthorized users.” It took 10 months to determine that patient data was present in the documents and records involved, with PHI exposure not confirmed until December 6, 2023.

The types of data involved included names along with one or more of the following: Social Security number, date of birth, driver’s license numbers, state identification numbers, passports, direct deposit bank information, medical information, and health insurance information. Notification letters were mailed on January 22, 2024, and individuals whose Social Security numbers were exposed have been offered complimentary credit monitoring and identity theft protection services.

Michigan Orthopaedic Surgeons Email Account Breach Affects 67,000 Patients

Michigan Orthopaedic Surgeons has recently notified 67,477 patients that some of their PHI was present in an email account that was accessed by unauthorized individuals. Suspicious activity was detected in the email account on or around June 29, 2023. A third-party forensic security company was engaged to investigate the incident and confirmed the email account had been accessed by an unauthorized individual between May 5, 2023, and June 21, 2023.

A comprehensive review of the account was initiated, and it was determined on October 20, 2023, that protected health information was present in the account. The types of information varied from individual to individual and may have included names in combination with one or more of the following: date of birth, Social Security number, financial account number, username and password, health insurance information, and medical information, such as diagnosis, lab results, and prescription information. Individual notifications were mailed on December 19, 2023, and complimentary credit monitoring services have been provided to the individuals who had their Social Security numbers exposed.

Prestige Care Suffers Ransomware Attack

Prestige Care, Inc., a Vancouver, WA-based senior care organization, has recently notified 38,087 individuals that some of their personal and protected health information was potentially accessed or acquired in a September 2023 ransomware attack. The attack was detected on September 7, 2023, with the investigation determining that malware had been installed that prevented access to certain files on its system. The investigation confirmed that the threat actor had access to files containing personal and health information on September 7.

The file review confirmed on December 18, 2023, that those files included names and Social Security numbers. Notification letters started to be sent to the affected individuals on January 31, 2024. Complimentary credit monitoring services have been offered for 12 months.

Bay Area Heart Center Impacted by Phishing Attack on Business Associate

Bay Area Heart Center in St. Petersburg, FL has confirmed that patient data was exposed in a cyberattack at the law firm Bowden Barlow Law, P.A., which Bay Area Heart Center uses for collections. An employee at the law firm responded to a phishing email, which provided the attacker with access to one of the law firm’s servers between November 17, 2023, and December 1, 2023. Bay Area Heart Center was notified about the breach on December 27, 2023.

The investigation found no evidence to suggest data had been downloaded, but data theft could not be ruled out. The exposed data included names, addresses, full and partial Social Security Numbers, dates of service, limited claims data, and insurance policy numbers. “Bay Area Heart Center takes this matter extremely seriously and is equally frustrated that its patient files were compromised by a third-party vendor,” explained the healthcare provider in its breach notice. “Given the potential impact this breach could have on patients, and in furtherance of its commitment to safety and security, the medical practice is currently reevaluating its partnership with Bowden Barlow Law.” Bay Area Heart Center said it has offered the affected individuals a one-year membership to a credit monitoring service.

Northern Light Health Says Patient Data Not Compromised in Cyberattack

On February 4, 2024, Northern Light Health in Brewer, ME, announced that it was forced to take its patient records system offline on February 3, 2024, after discovering certain computers had been compromised in a cyberattack.  Northern Light Health explained that none of the affected computers stored any patient data, and that the patient record system was taken offline while the incident was investigated. Northern Light Health said no third party has made contact demanding a ransom and the decision to take patient records offline was taken out of an abundance of caution. Downtime procedures were initiated immediately, and patient care was not disrupted.

Daily updates were provided on its website and on February 5, 2024, Northern Light Health said its medical record system was back online. The incident is still being investigated and there are still no indications that patient data was exposed.

The post Des Moines Orthopaedic Surgeons Notifies Patients About February 2023 Data Breach appeared first on HIPAA Journal.

On February 1, 2024, Ann & Robert H. Lurie Children’s Hospital in Chicago announced on its website and social media channels that it is responding to a cybersecurity incident and has been forced to take its network systems offline. The cyberattack has been reported to law enforcement agencies and Lurie Children’s is working collaboratively with those agencies and third-party cybersecurity experts to investigate the attack and bring network systems back online as soon as it is safe to do so.

The 360-bed acute care hospital is a leading provider of pediatric care in Illinois and one of the biggest children’s healthcare providers in the Midwest, serving 239,000 children each year. The cyberattack has disrupted normal operations and caused delays to medical care for certain patients, with ultrasound and CT scan results temporarily unavailable. Some appointments and elective procedures have been canceled to ensure patient safety. The hospital has confirmed that its emergency services are unaffected, and it is operating under a first-come, first-served approach and is prioritizing emergency patients.

The system-wide network outage has affected computers, Internet access, email, and phone lines at the main hospital, outpatient centers, and primary care offices. Lurie Children’s Hospital apologized for the inconvenience caused and said it is actively working to resolve the issue as soon as possible and is trying to minimize the disruption to patients as far as possible. Lurie Children’s has been working on establishing an emergency helpline to address patient families’ and community providers’ needs but it was not possible to provide a timeline for when normal operations will resume.

Little information has been disclosed so far about the nature of the attack. No ransomware groups appear to have claimed responsibility at this stage. Naturally, at such an early stage of the incident response, it is not possible to tell if any patient data has been stolen. Lurie Children’s will provide updates as the investigation progresses. Just a few days ago, another Chicago hospital confirmed that it had suffered a cyberattack. Saint Anthony Hospital fell victim to a LockBit ransomware attack in December. The LockBit group recently added the hospital to its data leak site as it sought payment of a $900,000 ransom and gave the hospital just 2 days to make payment to prevent the release of the stolen data.

The post Ann & Robert H. Lurie Children’s Hospital Responding to Cyberattack appeared first on HIPAA Journal.