HIPAA Breach News

Organizations Face Increased Scrutiny of Health Data Breaches

Posted by HIPAA Journal

Healthcare hacking incidents are increasing, there are new regulatory requirements and compliance initiatives due to Dobbs and Pixel use, and lawsuits against healthcare organizations over privacy violations are soaring. HIPAA-regulated entities and other organizations that operate in the healthcare space are now facing increased scrutiny of their data security practices and compliance programs, and the coming 12 months will likely see an increase in enforcement actions and lawsuits over privacy violations.

The recently published BakerHostetler Data Security Incident Response Report (DSIR) draws attention to these issues and provides insights into the threat landscape to help organizations determine how to prioritize their efforts and investments. The report, now in its 9th year, was based on 1,160 security incidents managed by BakerHostetler’s Digital Assets and Data Management Practice Group in 2022.

After a surge in ransomware attacks in 2021, 2022 saw a reduction in attacks; however, there was a surge in ransomware activity toward the end of the year and that surge has continued in 2023. That surge has coincided with increases in ransom demands, paid ransoms, and ransomware recovery times.  In 2022, the average ransom demand and payment increased in 6 out of the 8 industries tracked. In healthcare, the average ransom demand was $3,257,688 (median: $1,475,000) in 2022, and the average payment increased by 78% to $1,562,141 (median: $500,000). Across all industry sectors, paid ransoms increased by 15% to $600,688.

Network intrusions also increased and were the most common type of security incident, accounting for almost half of all data incidents covered in the report. BakerHostetler notes that companies have been getting better at detecting and containing these incidents, with dwell time decreasing from an average of 66 days in 2021 to 39 days in 2022. The time taken for containment fell from 4 days to 3 days, and investigation time decreased from 41 days in 2021 to 36 days in 2022.

The increase in hacking and ransomware attacks has prompted companies to invest more heavily in cybersecurity, and while security defenses have been enhanced, cybercriminals have found new ways of circumventing those defenses and attacking systems. Techniques that have proven successful in 2022 include MFA bombing, social engineering, SEO poisoning, and EDR-evading malware.

The cost of cyberattacks increased significantly in 2022, with forensic investigation costs increasing by 20% from last year in addition to increases in the cost of business disruption, data reviews, notification, and indemnity claims. Legal costs from data breaches have also increased significantly as it is now common for multiple lawsuits to be filed in response to data breaches.

Data breaches of 10,001 to 500,000 records see an average of 12-13 lawsuits filed and lawsuits are even being filed for smaller data breaches, with breaches of less than 1,000 records typically seeing 4 lawsuits filed. According to BakerHostetler, lawsuits have doubled since last year and we are now at a stage where legal action is almost a certainty following a data breach. There have been increases in lawsuits for violations of state privacy laws, and with a further 4 states enacting new privacy legislation in 2022 and one more due to introduce a new privacy law in 2023, the compliance landscape is becoming more complicated.

In the summer of 2022, a report was published by the Markup/STAT detailing an analysis of the use of pixels (tracking technologies) on hospital websites. These code snippets are typically added to websites to track visitor activity to improve websites and services, but the code also transmits identifiable visitor information to third parties. The extent to which these tools were being used – without the knowledge of website visitors – attracted attention from the HHS’ Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) with both issuing guidance on the use of these tools. OCR and the FTC have confirmed that Pixel-related violations of HIPAA and the FTC Act are now an enforcement priority, with the FTC having already taken action against entities over the use of these tracking tools. Law firms have been quick to sue healthcare organizations over these privacy breaches. More than 50 lawsuits have been filed against healthcare organizations in response to Pixel-related breaches since June 2022 when the report was published.

A further study of the use of Pixels by healthcare organizations suggests almost 99% of US non-federal acute care hospital websites had pixels on their websites that could transmit sensitive data, yet only a handful of healthcare organizations have disclosed Pixel-related data breaches to OCR so far. There could well be a surge in HIPAA enforcement actions by OCR and huge numbers of lawsuits filed in response to these breaches over the coming months.

There are also likely to be enforcement actions against HIPAA-regulated entities and non-HIPAA-regulated entities in the healthcare space for privacy violations involving reproductive health information, as both the FTC and OCR have stated that reproductive health information privacy will be an enforcement priority. OCR’s HIPAA Right of Access enforcement initiative is still ongoing, and compliance remains a priority for OCR.

BakerHostetler has also issued a warning about HIPAA compliance for non-healthcare entities, stressing that HIPAA applies to employer-sponsored health plans. There was an increase in data breaches at employer health plans in 2022 and these are likely to come under increased regulatory scrutiny, not just by OCR but also the Department of Labor which is increasingly conducting follow on investigations focusing on the overall cybersecurity posture of these plans. State Attorneys general have also started taking a much more active interest in the activities of healthcare entities, with investigations by state attorneys general into violations of HIPAA and state laws increasing in 2022.

BakerHostetler also identified a major increase in snooping incidents in 2022. These incidents include healthcare employees snooping on healthcare records and attempting to divert controlled substances. The increase confirms how important it is to create and monitor logs of system activity to detect malicious insider activity quickly. BakerHostetler notes that having systems in place that monitor for system activity anomalies is also key to rapidly detecting hacking and ransomware incidents.

“Securing an enterprise is a significant challenge — there are a lot of risks and just spending more money does not automatically equate to more effective security,” said Craig Hoffman, co-leader of BakerHostetler’s national Digital Risk Advisory and Cybersecurity team. “We see a lot of incidents, including what allowed them to occur and what was done to address the issue. Because enterprises do not have unlimited budgets and staff to implement and maintain new solutions, being able to share objective data about security incidents — from causes to fixes to consequences — helps clients decide where to prioritize their efforts.”

The post Organizations Face Increased Scrutiny of Health Data Breaches appeared first on HIPAA Journal.

Mailing Error at CMS Vendor Affects 10,000 Medicare Beneficiaries

Posted by HIPAA Journal

The Centers for Medicare & Medicaid Services (CMS) has started notifying certain Medicaid beneficiaries about an impermissible disclosure of some of their protected health information due to a mailing error at one of its contractors. The incident occurred at Palmetto GBA, which the CMS uses to handle claims. Between January 8 and January 29, 2023, Palmetto GBA mailed Medicare Summary Notices (MSNs) to Medicare recipients; however, a computer programming issue with its print mail services resulted in MSNs for the final quarter of 2022 being mailed to other Medicare beneficiaries within the same zip code.

The programming error was discovered by Palmetto GBA on February 7, 2023, and reported the incident to the CMS the same day. The CMS then worked with Palmetto GBA to identify the individuals affected and determined the error had resulted in 10,011 MSNs intended for Medicare beneficiaries in Alabama, Georgia, and Tennessee being sent to incorrect individuals. The MSNs contained the Medicare beneficiary’s name, address, claim number, dates of service, the last four digits of their Medicare Beneficiary number, and service/procedure descriptions with billing codes. The CMS believes that the risk of identity theft and Medicare fraud is minimal. Palmetto GBA has fixed the programming error and has increased reviews of printed mail for quality assurance purposes to protect against similar incidents in the future.

Adelanto HealthCare Ventures Phishing Attack Affects Patients of UHS of Delaware

UHS of Delaware, Inc. has recently notified 40,290 individuals about a data breach at a consulting company. In November 2021, Adelanto HealthCare Ventures (AHCV) suffered a phishing attack that allowed unauthorized individuals to access employee email accounts. The phishing incident was investigated, and it was determined that no protected health information had been exposed or stolen; however, on August 19, 2022, it was confirmed that some PHI had been exposed.

AHCV has improved its security measures in response to the incident to better protect against similar incidents in the future, including providing its workforce with further training. The incident affected several of its healthcare clients. You can find further information on the incident in this post.

PHI Exposed in Northeast Behavioral Health Care Consortium Phishing Attack

Northeast Behavioral Health Care Consortium (NBHCC) in Moosic, PA, has notified 13,240 patients that some of their protected health information has been exposed and potentially stolen. On February 20, 2023, NBHCC discovered an employee email account had been accessed by an unauthorized individual as a result of a response to a phishing email.

A review of the affected email account confirmed it contained protected health information such as names, member numbers, Medicaid numbers, diagnoses, detailed incident descriptions, and levels of care. NBHCC said it hasn’t identified any misuse of patient data and believes the primary goal of the attackers was to obtain other companies’ information; however, misuse of patient data could not be ruled out. A third-party cybersecurity firm was engaged to assist with the investigation and has taken action to mitigate risk and prevent similar incidents in the future.

The post Mailing Error at CMS Vendor Affects 10,000 Medicare Beneficiaries appeared first on HIPAA Journal.

Breach Notifications Increasing Lack Actionable Information on Breach Cause

Posted by HIPAA Journal

The Identity Theft Resource Center (ITRC) has published its report on data compromises in Q1, 2023, which shows a 13% reduction in data breaches and a 64% decrease in victims from the previous quarter. In Q1 there were 445 publicly reported data compromises and 89,140,686 confirmed victims. While a fall in data breaches and victim count is good news, both figures typically fall in the first quarter of the year. The 13% reduction is far less of a fall from the corresponding period last year when there was a 28.6% quarterly reduction in data breaches. The Q1, 2023 figures show a 10% increase in data compromises compared to 2022, and a 25.7% increase from Q1, 2021.

94% of victims of data compromises in Q1, 2023, came from data breaches in just 4 sectors – Manufacturing & Utilities, Technology, Healthcare, and Transportation. Healthcare was the worst affected sector for the third consecutive quarter with 81 compromises, followed by financial services with 70 compromises, others with 59 compromises, and manufacturing & utilities with 54 compromises. Two healthcare data breaches made the top 5 list for the quarter – The data compromise at Independent Living Systems (4,226,508 victims) and the breach at Regal Medical Group (3,300,638 victims).

84.9% of the data compromises were due to cyberattacks (378 incidents) and 19.1% were due to system and human errors (58 incidents). 48 of the data compromises were due to supply chain attacks, which affected 78 entities, and there were 54 confirmed ransomware attacks. There were 106 phishing attacks in Q1, which made phishing the most common attack vector.

There is a growing trend of withholding important information from data breach notifications to the point where some breach notifications have no actionable information about the root cause of the breach, which makes it hard for individuals to determine the level of risk that they face. The lack of information also makes it difficult to obtain meaningful statistics on the causes of data breaches.

“It is troubling to see the trend of a lack of actionable information in data breaches continue from 2022,” said Eva Velasquez, ITRC President and CEO. “Among the top ten breaches we saw in Q1, 60 percent did not include information about the root cause of the event, compared to 40 percent in Q4 2022. This means individuals and businesses remain at a higher risk of cyberattacks and data compromises.”

The post Breach Notifications Increasing Lack Actionable Information on Breach Cause appeared first on HIPAA Journal.

277,000 Santa Clara Family Health Plan Members Affected by GoAnywhere Hack

Posted by HIPAA Journal

Data breaches have recently been announced by Santa Clara Family Health Plan, United Steelworkers Local 286, Robeson Health Care Corporation, Two Rivers Public Health Department, and NewBridge Services.

Santa Clara Family Health Plan Confirmed as Victim of Clop GoAnywhere Hack

Santa Clara Family Health Plan has confirmed the 276,993-record data breach reported to the HHS’ Office for Civil Rights on March 30, 2023, was due to the hacking of Fortra’s GoAnywhere MFT solution by the Clop ransomware group. The group exploited a previously unknown (zero-day) vulnerability, exfiltrated data, but did not encrypt files. 130 organizations fell victim to the attacks over a 10-day period in late January/early February this year.

The incident affected NationsBenefits, which provides supplemental benefits administration services to several health plans, including Santa Clara Family Health Plan. NationsBenefits learned of the attack on February 7, 2023, and was informed by Fortra that the attack occurred on or around January 30, 2023. On February 13, 2023, NationsBenefits confirmed that the data compromised in the attack included protected health information such as name, address, phone number, gender, date of birth, health insurance number, medical ID number, Social Security number, date(s) of service, medical device or product purchased, and provider/caregiver name. NationsBenefits said it has stopped using the GoAnywhere solution and is implementing a range of additional measures to strengthen security.

United Steelworkers Local 286 Security Breach Affects Almost 38,000 Health Plan Members

United Steelworkers Local 286 has discovered an unauthorized individual gained access to an employee email account that included the protected health information of 37,965 members of its health plan. The email account breach was detected on February 13, 2023, and the forensic investigation confirmed the email account was accessed between June 16, 2022, and July 18, 2022.

A manual document review confirmed the account contained full names, Social Security numbers, dates of birth, financial account numbers, driver’s license and/or state identification numbers, passport numbers, financial account numbers, medical treatment information, medical record numbers, biometric information, and health insurance information.

No evidence of misuse of plan member data has been uncovered; however, as a precaution against identity theft and fraud, individuals whose Social Security numbers were exposed have been offered complimentary credit monitoring services. United Steelworkers Local 286 said security measures were in place and are continually evaluated and modified to ensure the privacy and security of employee data.

Two Rivers Public Health Department Reports Microsoft 365 Account Breach

Two Rivers Public Health Department (TRPHD) in Nebraska has recently confirmed that the protected health information of 15,168 patients was stored in an employee Office365 account that was accessed by an unauthorized third party.

TRPHD said suspicious activity was detected within its server infrastructure on November 9, 2022. The initial investigation conducted by a third-party IT firm concluded that patient data had not been compromised; however, out of an abundance of caution, an external forensic investigation firm was engaged to fully investigate the security breach and confirmed that an Office 365 account was accessed by an unauthorized individual between September 14, 2022, through November 8, 2022. The review of the account confirmed it contained protected health information, although the press release issued did not state what types of information had been exposed.

TRPHD said the document review was completed on March 15, 2023, and notifications were mailed to affected individuals on April 14, 2023. Additional security measures have been implemented to better secure its systems against unauthorized access.

Robeson Health Care Corporation Discovers Malware Infection

Robeson Health Care Corporation in Pembroke, NC, has reported a data breach to the Maine Attorney General that has affected up to 15,045 individuals. According to the notification, malware was detected within its network on February 21, 2023. The subsequent forensic investigation confirmed that an unauthorized third party had access to its systems between February 17, 2023, and February 21, 2023.

While evidence of data theft was not found, it could not be ruled out. The document review confirmed the following types of information were exposed: name, address, Social Security number, date of birth, treatment information/diagnosis, treating physician, medical record number, patient ID number, Medicare/Medicaid number, prescription information, health insurance information, and treatment costs. Notifications were mailed on April 21, 2023, and complimentary credit monitoring and identity theft protection services have been offered. Security has been enhanced to prevent similar incidents in the future, including implementing multi-factor authentication for all users.

NewBridge Services Hacking Incident Affects 1,457 Individuals

The Pequannock, NJ-based counseling service provider, NewBridge Services, said an unauthorized individual gained access to its systems and potentially accessed and obtained the protected health information of 1,457 individuals. The security breach was detected on January 26, 2023, when certain systems were disrupted. The forensic investigation confirmed on January 28, 2023, that protected health information had been exposed, although no evidence was found of actual or attempted misuse of that information.

The exposed information included names, Social Security numbers, dates of birth, treatment information, provider information, prescription information, payment information, and health insurance information. Written notifications were mailed to affected individuals on April 17, 2023, and security has been augmented to prevent similar incidents in the future.

The post 277,000 Santa Clara Family Health Plan Members Affected by GoAnywhere Hack appeared first on HIPAA Journal.

Former Methodist Hospital Employees Plead Guilty to Criminal HIPAA Violations

Posted by HIPAA Journal

Five former Methodist Hospital employees have pleaded guilty to criminal violations of HIPAA for accessing and disclosing the information of patients to a third party for financial gain. The former hospital workers were contacted by Roderick Harvey, 41, of Memphis, and were paid to provide him with the names and telephone numbers of patients who had been involved in motor vehicle accidents. The data collected by Harvey was then sold to personal injury attorneys and chiropractors.

The HIPAA Privacy Rule prohibits healthcare workers from accessing patient data unless there is a valid work reason for doing so, and disclosures of patient data to third parties are not permitted unless there is a valid reason for the disclosure (treatment, payment, business operations) unless consent is obtained from the patient. Accessing and disclosing patient information for financial gain without the consent of the patients is a criminal offense.

Between November 2017 and December 2020, Kirby Dandridge, 38, Sylvia Taylor, 43, Kara Thompson, 31, Melanie Russell, 41, and Adrianna Taber, 26, violated HIPAA and provided Harvey with patient information. The former employees were terminated for the HIPAA violations, and along with Harvey, were indicted by a federal grand jury in November 2022. Harvey faced a conspiracy charge and seven counts of obtaining patient information with the intent to sell it for financial gain. The former Methodist Hospital employees were separately charged for violating HIPAA.

Harvey pled guilty to the conspiracy charge on April 21, 2023, and will be sentenced on August 1, 2023. Harvey faces up to five years in jail, a fine of up to $250,000, and three years of supervised release. Dandridge, Taylor, Thompson, Russell, and Taber each face a maximum of one year in jail, $50,000 fine, and one year of supervised release and will be sentenced on five separate dates between April 25, 2023, and June 21, 2023.

The post Former Methodist Hospital Employees Plead Guilty to Criminal HIPAA Violations appeared first on HIPAA Journal.

One Brooklyn Health Notifies Patients About November 2022 Cyberattack

Posted by HIPAA Journal

One Brooklyn Health System, which operates three hospitals in Brooklyn, NY, has started notifying patients affected by a November 19, 2022, cyberattack. One Brooklyn Health made a public announcement in late November confirming that it was dealing with a cyberattack, and said it had shut down IT systems to contain the incident and had launched an investigation into the breach. Those systems remained offline for more than a week.

In late January, One Brooklyn Health confirmed that patient data had been compromised, and the attackers had access to information such as names, dates of birth, billing and claims data, treatment details, medical record numbers, prescriptions, health insurance information, and Social Security numbers. The review of the affected files was a time-consuming process, which took until March 21, 2023, to complete. Contact information then needed to be verified to allow breach notification letters to be mailed. One Brooklyn Health said it started mailing notification letters to affected patients on April 20, 2023.

One Brooklyn Health said the investigation revealed hackers had access to parts of its network between July 9, 2022, and November 19, 2022, and accessed data intermittently over that period. The incident is still showing the 500-record placeholder on the HHS’ Office for Civil Rights breach portal but has now been reported to the Maine Attorney General as affecting 235,251 individuals. One Brooklyn Health said it has reviewed and updated its policies and training protocols relating to data protection in response to the attack.

16,000 Patients Affected by Southwest Healthcare Services Cyberattack

Southwest Healthcare Services in North Dakota has recently started notifying 15,996 individuals about a recent cyberattack and data breach. Southwest Healthcare Services did not state when the breach was detected in its notification letters but explained that prompt action was taken when the incident was detected and third-party cybersecurity professionals were engaged to analyze the incident. On January 31, 2023, Southwest Healthcare Services learned that an unauthorized third party accessed and acquired files between October 28 and 29, 2022, and those files contained patient data.

A review of those files confirmed they contained names, addresses, dates of birth, medical record numbers, other internal identification numbers, driver’s license numbers, state ID numbers, clinical and treatment information, and health insurance information. A limited number of patients also had their Social Security numbers, financial account information, and/or payment card information compromised. Notification letters were mailed to affected individuals on March 31, 2023. Individuals who had their Social Security numbers exposed have been offered complimentary credit monitoring and identity theft protection services.

The post One Brooklyn Health Notifies Patients About November 2022 Cyberattack appeared first on HIPAA Journal.

Major Massachusetts Health Insurer Suffers Ransomware Attack

Posted by HIPAA Journal

Point32 Health, the second-largest health insurer in the state of Massachusetts, has announced it has experienced a ransomware attack that has resulted in system outages, including systems that are used to service its members, accounts, brokers, and providers.

Point32 Health is the parent company of Tufts Health Plan and Harvard Pilgrim Health Care and serves more than 2 million individuals in New England. Point32 Health said the outages have mainly affected Harvard Pilgrim Health Care customers, in particular, those with commercial or New Hampshire Medicare plans. Tufts Health Plan members are not understood to have been affected.

Point32 Health said it detected the presence of a malicious actor within its network on April 17, 2023, and took immediate action to contain the threat, which involved taking multiple systems offline while the attack was investigated and remediated. Efforts are underway to restore systems as soon as possible, and the staff and third-party cybersecurity experts are working around the close to bring systems back online.

The attack has caused disruption to providers and members, with some reportedly having experienced problems getting prior authorizations for medical procedures. Point32 Health said any members that require urgent assistance should call the member services number on their ID cards.

No ransomware gang appears to have claimed responsibility for the attack at this stage; however, ransomware gangs typically provide victims with a few days to pay the ransom before issuing public announcements. If the ransom is not paid, pressure is increased by publishing the stolen data.

At this stage of the investigation, it is unclear to what extent, if any, plan member data is involved. Point32 Health said that if the investigation confirmed that if personal or protected health information has been exposed or stolen, individual notifications will be mailed to those individuals as soon as possible.

The post Major Massachusetts Health Insurer Suffers Ransomware Attack appeared first on HIPAA Journal.

March 2023 Healthcare Data Breach Report

Posted by HIPAA Journal

Our monthly data breach reports are based on data breaches of 500 or more records that have been reported to the Department of Health and Human Services’ Office for Civil Rights (OCR) each month. The monthly reports provide an indication of the extent to which healthcare data breaches are increasing, decreasing, or remaining flat. To view longer-term healthcare data breach trends, visit our healthcare data breach statistics page.

Healthcare Data Breaches Reported in March 2023

In March, 63 breaches of 500 or more records were reported to OCR, which is a 46.51% increase from February, 6.92% more than the 12-month average, and 40% more breaches than in March 2022.

March 2023 Healthcare Data Breach Report - 12 month breaches

There was a 15.62% month-over-month increase in breached records, with 6,382,618 records exposed or impermissibly disclosed across the 63 data breaches. That’s 36% more records breached than the 12-month average and 76.46% more breached records than in March 2022.

March 2023 Healthcare Data Breach Report - 12 month breached records

Largest Healthcare Data Breaches

In March, 22 healthcare data breaches were reported that impacted more than 10,000 individuals, up from 17 such breaches in February 2023. Four of those breaches, including the largest data breach of the month, were due to the use of tracking code on websites that collected individually identifiable website visitor data. The data collected was used for analytics purposes but was transferred to the providers of the code. Those third parties included, but were not limited to, Meta (Facebook), Instagram, & Google. These tracking tools are not prohibited by the HIPAA Privacy Rule, but if they are used, consent must be obtained, or the disclosure must be permitted by the Privacy Rule and a business associate must be in place with the provider of the code. We can expect to see many more of these breaches reported over the coming weeks and months. According to a recently published study, 99% of U.S. hospitals have used these tools on their websites. Relatively few have reported tracking code-related data breaches to OCR.

Malicious actors continue to use ransomware in their attacks on healthcare organizations. Three of the top 22 data breaches were confirmed as involving ransomware, and several other hacking incidents were reported that involved network disruption, but were not reported as involving ransomware. Several threat actors that are known to use ransomware in their attacks on the healthcare sector are now choosing not to encrypt files, instead, they just steal data for extortion. For example, the Clop ransomware group typically deploys ransomware in its attacks but in recent attacks that exploited a vulnerability in Fortra’s GoAnywhere managed file transfer (MFT) solution, ransomware was not deployed. The group stole data from 130 organizations in the attacks, including Community Health Systems Professional Services Corporations and US Wellness Inc, both of which are in the top 22 list.

There were three 10,000+ record data breaches involving the hacking of email accounts – through phishing or other means. Phishing attacks are common in healthcare, and while these attacks can be difficult to prevent, it is possible to limit the harm caused by placing time limits on how long emails are stored in email accounts. While emails often need to be retained for compliance with HIPAA and other laws –  moving them to a secure archive can help to reduce the extent of a data breach if email accounts are compromised. One of the phishing attacks saw one email account compromised that contained the PHI of more than 77,000 individuals.

Name of Covered Entity State Covered Entity Type Individuals Affected Cause of Breach
Cerebral, Inc DE Business Associate 3,179,835 Website tracking code – Impermissible disclosure to third parties
ZOLL Services LLC MA Healthcare Provider 997,097 Hacking incident (details not made public)
Community Health Systems Professional Services Corporations (CHSPSC), LLC TN Business Associate 962,884 Hacking of Fortra’s GoAnywhere MFT solution
Santa Clara Family Health Plan CA Health Plan 276,993 Hacking incident involving business associate – no information available
Monument, Inc. NY Business Associate 108,584 Website tracking code – Impermissible disclosure to third parties
Bone & Joint Clinic, S.C. WI Healthcare Provider 105,094 Hacking incident: Network disruption and data theft
Florida Medical Clinic, LLC FL Healthcare Provider 94,132 Ransomware attack
Healthy Options dba Postal Prescription Services – Kroger OH Healthcare Provider 82,466 Impermissible disclosure of PHI to Kroger
NorthStar Emergency Medical Services AL Healthcare Provider 82,450 Hacking incident (details not made public)
Merritt Healthcare Advisors CT Business Associate 77,258 Unauthorized accessing of employee email account
NewYork Presbyterian Hospital NY Healthcare Provider 54,396 Website tracking code – Impermissible disclosure to third parties
Trinity Health MI Business Associate 45,350 Phishing attack: employee email account compromised
UHS of Delaware, Inc. PA Business Associate 40,290 Unauthorized accessing of employee email account
SundaySky, Inc. NY Business Associate 37,095 Hacked cloud server – data theft confirmed
Denver Public Schools Medical Plans CO Health Plan 35,068 Hacked network server – data theft confirmed
Atlantic General Hospital MD Healthcare Provider 26,591 Ransomware attack
UC San Diego Health CA Healthcare Provider 23,000 Website tracking code used by a business associate – Impermissible disclosure to third parties
Tallahassee Memorial Healthcare, Inc. FL Healthcare Provider 20,376 Hacked network server – data theft confirmed
Northeast Surgical Group, PC MI Healthcare Provider 15,298 Hacked network server
Health Plan of San Mateo CA Health Plan 11,894 Unauthorized accessing of employee email account
US Wellness Inc. MD Business Associate 11,459 Hacking of Fortra’s GoAnywhere MFT solution
Codman Square Health Center MA Healthcare Provider 10,161 Ransomware attack

Causes of March 2023 Data Breaches

The majority of the month’s reported breaches were classified as hacking/IT incidents, as has been the case for many months. While hacking incidents usually account for the vast majority of breached records, in March they accounted for only 54.29% of the month’s breached records due to very large data breaches caused by the use of tracking technologies. The average size of a hacking incident in March was 73,724 records and the median breach size was 2,785 records.

March 2023 Healthcare Data Breach Report - causes

There were 14 data breaches reported as unauthorized access/disclosure incidents and while they only accounted for 22.22% of the month’s data breaches, they were responsible for 45.65% of the breached records, mostly due to the website tracking code breaches. The average breach size was 208,114 records and the median breach size was 2,636 records. There was one theft incident reported involving the protected health information of 3,013 individuals and one improper disposal incident involving 999 records.

March 2023 Healthcare Data Breach Report - data location

Where Did the Breaches Occur?

The entity reporting a data breach is not always the entity that experienced the breach. Business associates of HIPAA -covered entities may self-report breaches, but it is common for the covered entity to report the breaches. The data submitted to OCR indicates breaches occurred at 33 healthcare providers, 24 business associates, and 6 health plans. The pie charts below are based on where the breaches actually occurred rather than the reporting entity, as this provides a clearer picture of the extent to which data breaches are occurring at business associates.

March 2023 Healthcare Data Breach Report - breaches at hipaa-regulated entities

The pie chart below shows the extent to which patient and health plan member records have been exposed or compromised at business associates. 75.4% of the month’s breached records were due to data breaches at business associates.

March 2023 Healthcare Data Breach Report - records breached at hipaa-regulated entities

Geographical Distribution of March 2023 Data Breaches

Data breaches were reported by HIPAA-regulated entities in 25 U.S. states in March, with New York topping the list with 18 reported data breaches. The unusually high total was due to an attack on a business associate – Atlantic Dialysis Management Services – which reported the breach separately for each affected client and submitted 14 separate breach reports to OCR.

State Breaches
New York 18
California 7
Florida, Massachusetts, Ohio, Pennsylvania & Texas 3
Indiana, Kansas, Maryland, Michigan & Oregon 2
Alabama, Arizona, Colorado, Connecticut, Delaware, Georgia, Illinois, Kentucky, New Jersey, Oklahoma, Tennessee, Wisconsin & West Virginia 1

HIPAA Enforcement Activity in March 2023

No HIPAA enforcement actions were announced by the HHS’ Office for Civil Rights in March, but there was one enforcement action by a state Attorney General. The New York Attorney General confirmed that a case had been settled with the law firm, Heidell, Pittoni, Murphy & Bach LLP. The law firm was investigated following a breach of the personal and protected health information of 61,438 New York residents to identify potential violations of HIPAA and New York laws. The law firm chose to settle the case with no admission of wrongdoing and paid a financial penalty of $200,000. The New York Attorney General alleged violations of 17 HIPAA provisions and implementation specifications, details of which can be found here.

While the Federal Trade Commission does not enforce HIPAA, the agency has started taking action over breaches of healthcare data by non-HIPAA-covered entities to resolve violations of the FTC Act and the FTC Health Breach Notification Rule. In February, the FTC announced that its first settlement had been reached for a health data breach notification failure and that was followed up with a second enforcement action in March. The FTC announced that the online counseling service provider, BetterHelp, had agreed to settle alleged FTC Act violations related to impermissible disclosures of health data to third parties when users of its services had been told their information was private and confidential.  While there was no fine, under the terms of the settlement, $7.8 million will be paid to the consumers affected by the breach and they must be notified per the Health Breach Notification Rule.

The post March 2023 Healthcare Data Breach Report appeared first on HIPAA Journal.

Medtronic Alerts InPen App Users About Disclosures of Personal Data to Google

Posted by HIPAA Journal

The medical device manufacturer Medtronic – dba Medtronic MiniMed and MiniMed Distribution Corp (Medtronic Diabetes) – has recently confirmed that the personal information of users of its InPen Diabetes Management App on iOS and Android have had some of their personal information disclosed to Google due to the use of tracking and authentication code within the InPen App.

The app utilized Google Analytics for Firebase, Crashlytics for Firebase, and Firebase Authentication. These tools disclosed certain information about app users to Google, especially when users were logged into their Google accounts at the same time that they used the InPen App. As a result, their identities and information about online activities were shared with Google. The tools were used by Medtronic Diabetes to gather information about the use of the app, identify technical issues, assess app performance, and understand user needs to provide care to customers and improve services.

Medtronic Diabetes said the data collected by these tools is analyzed at a consolidated rather than individual level and does not directly identify individual patient information, but it was determined that certain information was transmitted to Google when users were logged into their Google accounts. Medtronic Diabetes said an internal investigation was launched into the use of these tracking technologies when the potential for unauthorized disclosure of user data was discovered to determine exactly what information was potentially shared with Google.

The decision was taken to notify all users who registered for or used an InPen account since September 2020, as they may have been affected. The data disclosed to Google was dependent on user interactions with the app, and other factors, such as the browser used, whether cookies had been cleared, and if they were logged into Google when using the app.

Medtronic Diabetes said that information disclosed may have included: email address, IP address, phone number, InPen App user name and password, timestamp information related to specific InPen App events, and certain unique identifiers tied to the InPen account or mobile device. The latter includes a unique Medtronic Diabetes user identifier, unique numbers attributed to each instance the InPen App is downloaded to a particular device, and identifiers tied to a mobile device such as a MAID, IDFA, AAID, and/or IDFV.

Medtronic Diabetes said Google Analytics has been removed from the latest version of the InPen app, and plans have been made to transition from Crashlytics and Firebase Authentication to other crash reporting and authentication systems.

La Clínica de La Raza Reports Email Breach

La Clínica de La Raza in Oakland, CA, has reported a breach of the protected health information of 15,316 individuals. Suspicious activity was detected within certain employee email accounts on February 8, 2023, and steps were immediately taken to secure the accounts. Assisted by a third-party computer forensics firm, La Clínica was able to confirm that a limited number of employee email accounts had been accessed by unauthorized individuals at various times between January 24, 2023, and February 8, 2023.

A review of all affected email accounts and La Clínica confirmed on April 4, 2023, that they contained patient information such as names, addresses, dates of birth, financial account or payment card information, online credentials, Social Security numbers, medical treatment information, and/or health insurance information.

Affected individuals are being notified by mail and complimentary identity protection and credit monitoring services have been offered to individuals whose Social Security numbers were exposed.

The John Muir Health Says Walnut Creek Medical Center Patient Data Has Been Exposed

John Muir Health is notifying certain Walnut Creek Medical Center patients that some of their protected health information has been exposed and potentially accessed by unauthorized individuals. The Californian healthcare provider was notified about the exposure on March 22, 2023. A member of staff at the medical center created a website in order to communicate with other staff members more efficiently about the use of medical devices and centralize information such as vendor sites, order forms, and equipment information. The website included a link to an Excel spreadsheet that contained patient information. The information in the spreadsheet was intended to be accessed internally by authorized individuals; however, it could also be accessed by individuals outside of John Muir Health. The spreadsheet contained information such as names, facility, room, diagnosis, condition, and dates.

John Muir Health said the link to the Excel file was disabled on March 23, 2023, and the website was decommissioned on March 24, 2023. The investigation confirmed that the spreadsheet had not been accessed by any unauthorized third party between September 28, 2022, and March 23, 2023, but due to limited audit records, it was not possible to determine if there had been unauthorized access between July 1, 2021, and September 27, 2022

Affected individuals have been notified by mail. The incident has been reported to the California Attorney General but is not yet appearing on the HHS’; Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Medtronic Alerts InPen App Users About Disclosures of Personal Data to Google appeared first on HIPAA Journal.