Kannact Inc., an Albany, OR-based home care service, says it detected unauthorized access to its computer network on March 13, 2023. A third-party cybersecurity firm was engaged to investigate the incident and confirmed that the parts of the network that were accessed contained patients’ protected health information, although, at this stage of the investigation, it is unclear if patient data was viewed or copied from its systems. Kannact has received no reports at the time of providing notice to indicate any misuse of patient data.

The review of the files that could potentially have been accessed revealed they contained a range of information, which varied from individual to individual. Information potentially compromised included names in combination with one or more of the following data elements: date of birth, address, phone number, Social Security Number, driver’s license number, and health information such as medical diagnosis, treatment information, and pharmaceutical records.

Kannact said that it disabled its third-party managed file transfer software, deactivated all related API keys, and is improving its patient data ingestion process. Individuals whose Social Security and driver’s license numbers were impacted have been offered complimentary credit monitoring and identity theft protection services.

The incident was reported to the HHS’ Office for Civil Rights on June 20, 2023, as affecting up to 103,547 individuals.

Vincera Institute Falls Victim to Ransomware Attack

Vincera Institute in Philadelphia, PA, has confirmed that it fell victim to a ransomware attack on April 29, 2023. Immediate action was taken to secure its systems to prevent further unauthorized access to its network and patient information, and cybersecurity professionals were engaged to investigate the incident. In a June 20, 2023, press release, Vincera Institute said the investigation into the data breach is ongoing, but it has been determined that the threat actors behind the attack had access to parts of its network that contained patient information; however, unauthorized access to and misuse of patient data has not been detected.

The files potentially accessed in the attack included full names, addresses, phone numbers, email addresses, Social Security numbers, date of birth, medical histories and treatment records, insurance information, and other information provided by patients. Security safeguards have been enhanced in response to the incident, and monitoring processes have been improved.

The incident was reported to the HHS’ Office for Civil Rights on June 20, 2023, in four breach reports, covering Vincera Imaging LLC (5,000 individuals), Vincera Rehab LLC (5,000 individuals), Vincera Surgery Center (5,000 individuals), and Core Performance Physicians, dba Vincera Core Physicians (10,000 individuals).

The post Kannact & Vincera Institute Fall Victim to Cyberattacks appeared first on HIPAA Journal.

Atlanta Women’s Health Group, P.C., has recently confirmed that the protected health information of up to 33,839 current and former patients has been exposed and potentially stolen in an April 2023 cyberattack. A security breach was detected on April 12, 2023, and third-party cybersecurity experts were engaged to determine the nature and scope of the incident. The investigation confirmed there had been access to patient information, but the breach report did not state whether that information was copied from its systems. Atlanta Women’s Health Group said that at the time of issuing notification letters, no evidence had been found to indicate any misuse of patient data.

For the majority of patients, the information exposed in the attack was limited to names, birth dates, patient ID numbers, and other information that may have been included in medical records. Third-party cybersecurity experts have been engaged to implement additional cybersecurity measures to prevent further data breaches. Affected patients are being encouraged to monitor their credit reports, health account statements, and explanation of benefit forms for suspicious activity.

Blue Cross Vermont Says 16,000 Individuals Affected by January Cyberattack

Approximately 16,000 members of Blue Cross Vermont health plans have had their protected health information compromised in a January 2023 cyberattack. Hackers exploited a zero-day vulnerability in Fortra’s GoAnywhere MFT file transfer solution and accessed and stole sensitive data such as names, birth dates, addresses, medical information, and insurance information. Around 5% of the affected individuals also had their financial information stolen.

Approximately 13,700 of the affected individuals were members of Vermont Blue Advantage Health Insurance Plans, around 2,250 individuals were members of Vermont Blue Advantage Plans, and the remainder of the affected individuals were members of other insurance plans. Notification letters were sent to affected individuals by NationsBenefits, which was the business associate that used GoAnywhere MFT solution that was compromised. NationsBenefits has offered affected individuals 24 months of complimentary credit monitoring services.

New Horizons Medical Breach Impacts 12,317 Patients

New Horizons Medical, Inc., a Massachusetts-based provider of mental health, psychiatry, and substance use treatment services, has recently reported a data breach to the Maine Attorney General that has affected up to 12,317 patients. Unauthorized network access was detected on April 19, 2023, and a third-party forensic investigation was launched to determine the nature of the incident and the extent to which patient data was involved. The investigation revealed unauthorized individuals had access to its network between February 12, 2023, and April 23, 2023, and during that time may have viewed or copied patient information.

The analysis of the affected files confirmed they contained names along with one or more of the following types of information: address, date of birth, Social Security number, driver’s license number, financial account information, medical records number, health insurance plan member ID, claims data, diagnosis, and prescription information. Notification letters were sent to affected individuals on June 16, 2023. Complimentary credit monitoring and identity protection services have been offered to eligible individuals. New Horizons Medical has also confirmed that additional safeguards and technical security measures have been put in place to further protect and monitor its information systems.

Data Security Incident Reported by CareNet Medical Group

CareNet Medical Group in New York has started notifying 3,359 patients that some of their protected health information has been stolen in a security incident. The breach notice does not state when the security incident was detected but the investigation revealed on April 26, 2023, that its network was accessed by an unauthorized individual between May 9, 2022, and June 4, 2022, during which time files were copied from its network.

The compromised information included full names, addresses, driver’s license numbers, bank account numbers/routing numbers, dates of birth, medical reference numbers, Medicare numbers, cell phone numbers, home phone numbers, health insurance information, email addresses, and Social Security numbers. Notification letters were sent to affected individuals on June 2, 2023, and complimentary credit monitoring services have been offered to individuals whose Social Security numbers were exposed.  No explanation was provided as to why it took almost 11 months to determine that patient data had been compromised.

The post Atlanta Women’s Health Group Data Breach Impacts 33,800 Patients appeared first on HIPAA Journal.

Commonwealth Health Physician Network-Cardiology, aka Great Valley Cardiology in Scranton, PA, has notified 181,764 current and former patients about a cyberattack and data breach that was discovered on April 13, 2023. The forensic investigation confirmed that the information potentially compromised in the attack included names in combination with addresses, birth dates, Social Security numbers, driver’s license numbers, passport numbers, bank account and credit/debit card information, diagnosis, medications, lab test results, and health insurance/claims information.

Hackers first gained access to Great Valley Cardiology’s systems on February 2, 2023, and access remained possible until its systems were secured on April 14, 2023. The healthcare provider was reportedly notified about the attack by the Department of Homeland Security, with access to its systems gained as a result of a successful brute force attack.

Affected individuals have been offered complimentary credit monitoring and identity theft protection services for 24 months as a precaution, although there are no indications that there has been any misuse of patient data as a result of the security breach.

EpiSource Confirms Breach of its AWS Environment

The Gardena, CA-based medical coding vendor, EpiSource, has confirmed that the protected health information of patients of its healthcare clients has been exposed and potentially compromised in a February 2023 cyberattack on its Amazon Web Services (AWS) environment.

The cyberattack was detected by its threat detection system on February 20, 2023. The investigation confirmed its AWS environment had been accessed by an unauthorized individual between February 19 and 21, 2023. The forensic investigation confirmed on April 20, 2023, that health and personal information had potentially been accessed or obtained such as names, dates of birth, addresses, phone numbers, medical record numbers, health plan ID numbers, provider information, diagnoses, and medications. EpiSource said security controls and monitoring practices have been enhanced following the attack and affected individuals have been offered one year of complimentary identity theft protection services.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many people have been affected.

Business Associate Data Breach Impacts 25K UPMC Patients

University of Pittsburg Medical Center (UPMC) has confirmed that approximately 25,000 patients have been affected by a data breach at a business associate that provides billing and collection services. The data breach occurred at Intellihartx LLC, which is issuing notifications to the affected UPMC patients. The breach involved names, addresses, Social Security numbers, and other personal information. Complimentary credit monitoring services have been offered to affected individuals. Intellihartx reported the breach to the Maine Attorney General as affecting 489,830 individuals. Further information on the data breach has been covered by The HIPAA Journal here.

Idaho Medicaid Recipients Affected by Data Breach at Claims Processor

The Idaho Department of Health and Welfare has confirmed that the personal information of 2,501 Medicaid recipients has potentially been accessed and/or obtained in a data breach at its claims processor, Gainwell Technologies. An unauthorized individual obtained credentials that allowed access to be gained to the Gainwell portal, which allowed access to information such as names ID numbers, billing codes, and treatment information.

The breach was discovered on May 12, 2023, and following an investigation and review, affected individuals were notified on June 9, 2023. Credit monitoring and identity theft protection services have been offered to affected individuals.

Utah Department of Health and Human Services Notifies 5,800 Health Plan About Mailing Error

The Utah Department of Health and Human Services (DHHS) has confirmed that the protected health information of 5,800 Medicaid recipients has been impermissibly disclosed due to a mailing error. As a result of the error, benefit letters were accidentally grouped together and sent to incorrect individuals. The error was discovered on May 8, 2023, and the mailing process was halted to prevent further impermissible disclosures.

The letters included Medicaid benefit information, although only around 200 of the 5,800 individuals affected had either their Medicare health insurance claim number (HICN) or Social Security number disclosed. Those individuals have been offered complimentary credit monitoring services. The DHHS said it has worked with its business associate, Client Network Services (CNSI), to ensure the error is corrected and system testing and quality protocols have been enhanced.

The post Great Valley Cardiology Notifies 181,700+ Individuals About PHI Exposure appeared first on HIPAA Journal.

Johns Hopkins University and Johns Hopkins Health System are investigating a May 31, 2023, cyberattack and data breach that targeted a widely used software tool. While the tool that was targeted was not mentioned in the attack, the breach date coincides with the Clop/FIN11 attacks on the MOVEit Transfer managed file transfer solution.

While the investigation into the data breach is ongoing, the initial findings indicate that sensitive personal and financial information was impacted, including names, contact information, and health billing records. Notifications will be sent to all affected individuals in the coming weeks once the full scope and breadth of the breach are determined. Johns Hopkins has confirmed that credit monitoring services will be offered to affected individuals. In the meantime, Johns Hopkins urges all students, faculty staff, and their dependents to take immediate action to protect their personal information, including conducting reviews of their statements, credit reports, and accounts for unusual activity, and should consider placing a fraud alert and credit freeze with a national credit bureau.

At this stage, it is unclear how many individuals have been affected.

PHI of 33,000 Patients Exposed in Maimonides Medical Center Cyberattack

Maimonides Medical Center in Brooklyn, NY, has confirmed that the protected health information of approximately 33,000 patients was stored on systems that were accessed by an unauthorized individual. The security breach was discovered on April 4, 2023, and unauthorized access was immediately blocked. The forensic investigation confirmed the initial access occurred on March 18, 2023.

The review of affected files revealed the majority of individuals only had their names, addresses, and limited clinical information exposed, such as diagnoses and treatment information; however, some individuals also had their Social Security numbers exposed. Affected individuals have been offered 24 months of complimentary credit monitoring and identity theft protection services. Third-party cybersecurity experts were hired to assess system security and ensure that adequate safeguards were in place, and additional authentication measures have now been implemented.

iSpace Inc. Notifies 24,400 Individuals About Data Breach

iSpace, Inc., a provider of insurance eligibility services, has recently started notifying 24,382 individuals about a cyberattack that was discovered on February 5, 2023. In a May 31, 2023, notification to the California Attorney General, iSpace explained that the forensic investigation confirmed a system compromise had occurred and that there was file exfiltration between January 30 and February 5, 2023.

The analysis of the impacted files confirmed that they contained names, Social Security numbers, dates of birth, diagnosis information, health insurance group/policy numbers, health insurance information, subscriber numbers, and prescription information. At the time of issuing notifications, no actual or attempted misuse of the affected individuals’ information had been detected. iSpace said it engaged the services of security specialists to assist in examining its privacy and security policies and practices and will update them accordingly. The delay in issuing notifications was due to the lengthy investigation and data review process, which was completed on March 3, 2023, and the subsequent verification of contact information.

Normal Operations Resume After Richmond University Medical Center Ransomware Attack

Richmond University Medical Center (RUMC) in West Brighton, NY, has confirmed that it has fully recovered from a ransomware attack that was detected in the first week of May. The attack forced the medical center to shut down systems and activate its emergency protocols, and the staff recorded patient information manually while systems were restored. The investigation into the ransomware attack is ongoing to determine the extent to which patient information was involved, and notification letters will be sent to affected individuals when that process has been completed.

The post Johns Hopkins Investigating Cyberattack and Data Breach appeared first on HIPAA Journal.