The Williamsport Home, a retirement village in Pennsylvania, and Senior Choice, Inc., a provider of skilled nursing care at three inpatient facilities in Pennsylvania – The Atrium in Johnstown, Beacon Ridge in Indiana, and The Patriot in Somerset – have been affected by a cyberattack that was detected on April 24, 2023.

Steps were immediately taken to secure the network when the security breach was detected and while the investigation into the cyberattack is ongoing, it has been determined that unauthorized individuals gained access to certain business operation systems between April 18 and April 24, 2023. The systems used directly for residential care do not appear to have been compromised; however, the business systems compromised in the attack contained protected health information that was potentially accessed or obtained.

The types of information that were exposed varied from individual to individual and may have included one or more of the following: Name, address, birth date, admission date, discharge date, death date, medical record number, provider or facility name, medical condition, diagnosis and/or treatment information, lab results, medications, payment amount history information, insurance payment amount information, date of service, Social Security number, financial account information, credit card number, medical information, health insurance information, driver’s license or state identification number, passport number, and any information on an individual that was created, used, or disclosed in the course of providing health care services.

Additional technical safeguards are being implemented to improve security to prevent similar breaches in the future. It has not yet been determined how many individuals have been affected so all individuals that are currently receiving services or have done in the past should therefore be vigilant against any misuse of their information. To meet the breach reporting requirements of the HIPAA Breach Notification Rule, the breach has been reported to the HHS by The Williamsport Home and Senior Choice as affecting at least 500 individuals. The totals will be updated when it has been confirmed how many individuals have been affected.

The post Cyberattack Affects Multiple Residential Care Facilities in Pennsylvania appeared first on HIPAA Journal.

The Illinois-based healthcare provider, Activate Healthcare, LLC, has recently confirmed that it suffered a security breach that resulted in the theft of patient data. Suspicious activity was detected within its IT systems on April 27, 2023, and the subsequent forensic investigation confirmed that an unauthorized third party had access to its network between April 22, 2023, and April 28, 2023.

On April 29, 2023, it was confirmed that files had been exfiltrated that included patient information such as names, dates of birth, addresses, Social Security numbers, driver’s license numbers, and clinical information, such as provider names, dates of service, and/or diagnoses. At the time of issuing notification letters, no evidence of misuse of patient data had been detected; however, as a precaution, affected individuals have been offered complimentary credit monitoring and identity protection services.  Activate Healthcare said steps will continue to be taken to enhance the security of its computer systems.

The breach has been reported to the HHS’ Office for Civil Rights as affecting up to 93,761 patients.

Community Research Foundation Confirms 30,000-Record Data Breach

Community Research Foundation (CRF), a San Diego, CA-based non-profit research foundation that develops and operates programs focused on the treatment, education, and rehabilitation of individuals with mental health problems and substance use problems, has recently confirmed that sensitive health data was accessed by an unauthorized individual last year.

CRF detected a security breach on October 13, 2022, and third-party cybersecurity experts were engaged to investigate the incident. CRF said the review of the affected files concluded on April 19, 2023, when it was determined that the protected health information of individuals who sought medical services through medical and/or social service programs that CRF supports was involved. That information included names, Social Security numbers, driver’s license numbers, dates of birth, medical treatment and/or diagnosis information, and/or health insurance information.

CRF said after confirming which individuals had been affected, contact information needed to be verified to allow notification letters to be mailed, hence the delay in issuing notifications. The breach notice makes no mention of when access to its systems was gained, and credit monitoring services do not appear to have been offered to affected individuals.

The data breach was recently reported to the HHS’ Office for Civil Rights as affecting up to 30,057 individuals.

Henrietta Johnson Medical Center Patients Affected by Data Breach at Delaware Health Network

The Henrietta Johnson Medical Center (HJMC) in Wilmington, DE, has been affected by a security incident at the healthcare-controlled network provider and electronic health records management provider, Delaware Health Network (DHN). According to the HJMC notice, unauthorized individuals gained access to certain DHN systems on or around April 5, 2023, and copied files from those systems. DHN is currently investigating the incident to determine the extent of the data breach but has notified HJMC and other clients that their data may have been impacted.

HJMC has not yet been informed of the number of patients that have been affected. Based on the findings of the forensic investigation to date, the following data types may have been exposed: full name, dates of birth, ethnicity, medical record number, diagnosis code, lab information, and health insurance information. DHN has confirmed that Social Security numbers and financial account information were not viewed or stolen.

HJMC said it is reviewing its policies and procedures relating to third-party vendors and will continue to pursue information from DHN about the event. Out of an abundance of caution, notifications will be sent to all patients. The breach has been reported to the HHS’ Office for Civil Rights as affecting 500 individuals. That number will be updated when DHN confirms how many patients have been affected.

The post Activate Healthcare Reports Security Breach Affects Up to 93,761 Patients appeared first on HIPAA Journal.

Metro Health System in Cleveland, OH, has discovered an employee has accessed patient records without a valid work reason. The unauthorized access was discovered on April 27, 2023, and the subsequent investigation confirmed that patient records had been accessed without authorization at various times over the past 15 years. The earliest incident occurred in 2008.

The information viewed included patient names, dates of birth, and clinical information. No Social Security numbers or financial information were accessed. A spokesperson for Metro Health said the employee has been disciplined per its sanctions policy and no evidence has been found to indicate redisclosure of patient data or any misuse of that information. Affected individuals are being notified by mail, steps are being taken to improve its privacy practices, and further training has been provided to the workforce.

COX Health Affected by Hacking of Fortra GoAnywhere File Transfer Solution

Springfield, MO-based CoxHealth has recently confirmed that patient data was compromised in a January 2023 cyberattack on its billing vendor, Intellihartx. The Clop ransomware group exploited a vulnerability in Fortra’s GoAnywhere Managed File Transfer (MFT) solution, stole sensitive data, and demanded a ransom to prevent the release of that information.

CoxHealth says up to 203,000 patients had their protected health information stolen in the attack, including names, addresses, birth dates, Social Security numbers, diagnoses, and billing and insurance information. The 203K figure is the maximum number of patients that could have been affected. It was not possible to determine with any degree of certainty exactly how many individuals had been affected. Intellihartx has offered complimentary credit monitoring and identity theft protection services to affected individuals.

SoutheastHealth Issues Statement About Potential Vendor Breach

SoutheastHealth in Cape Girardeau, MO, has issued a statement about a potential data breach at a vendor, ITX (Intellihartx).  SoutheastHealth said it learned about a potential breach when one of its patients said they had received a letter from Intellihartx saying their protected health information had been exposed and potentially stolen.

SoutheastHealth said names, addresses, dates of birth, billing information, insurance information, diagnoses, medications, and Social Security numbers were potentially stolen in the attack on the file transfer solution and confirmed that its own systems were not affected. SoutheastHealth said it does not currently have a business relationship with Intellihartx and no formal notification was received from Intellihartx confirming SoutheastHealth was one of the companies affected.

The post 15-Year Employee Privacy Breach Discovered by Metro Health System appeared first on HIPAA Journal.

In March 2023, Atlantic General Hospital notified the Maine Attorney General that it had fallen victim to a ransomware attack in which the protected health information of 30,704 individuals was exposed; however, the ransomware attack was far more extensive than was previously thought and the total has been upwardly revised to 136,981 individuals.

The attack was detected on January 29, 2023, and the forensic investigation confirmed hackers had access to its network between January 20 and January 29, 2023. The initial review of files that were potentially compromised in the breach was completed on March 6, 2023, and confirmed that names, medical record numbers, treating/referring physician names, health insurance information, subscriber numbers, medical history information, and diagnosis/treatment information may have been accessed or acquired. Notification letters were sent on March 24, 2023, and complimentary credit and identity monitoring services were offered to affected individuals.

The investigation into the attack continued, and additional files were discovered to have been compromised. The review of those files was completed on May 15, 2023, and after obtaining up-to-date contact information, additional notification letters were sent to affected individuals on June 22, 2023. The compromised information included names in combination with one or more of the following: Social Security number, date of birth, financial account information, medical/treatment information, and health insurance information. Those individuals have also been offered complimentary credit and identity monitoring services. Atlantic General Hospital says it is working on implementing additional safeguards to improve data security and has provided further training to its workforce.

Palomar Health Patients Impacted by PharMerica Ransomware Attack

Palomar Health in San Diego, CA, has recently confirmed that patient data was exposed in a ransomware attack on its business associate, PharMerica, a nationwide provider of pharmacy services. The ransomware attack was detected on or around March 14, 2023, and the forensic investigation confirmed that at least 5,815,591 individuals had been affected. The attack was conducted by the Money Message ransomware group, which added the stolen data to its leak site in late March. The attack has been covered in more detail here.

Palomar Health has confirmed that the following data was potentially compromised in the attack: name, address, date of birth, Social Security number, medications, and health insurance information. Individuals affected received care at Palomar Continuing Care Center in Escondido or The Villas at Poway (Villa Pomerado) between 2001 and 2020. PharMerica is offering complimentary credit and identity theft monitoring services to the affected individuals and is issuing notification letters to patients directly. It is currently unclear how many Palomar Health patients have been affected.

Desert Physicians Management Cyberattack Affects Patients of its Healthcare Provider Clients

Desert Physicians Management in Apple Valley, CA, a provider of administrative support services to physicians’ groups, including Choice Physicians Network/Choice Medical Group, Choice Healthcare Associates, and Horizon Valley Medical Group, has recently announced that unauthorized individuals gained access to its computer systems and copied certain files from its network.

The security breach was detected on April 23, 2023, and the forensic investigation confirmed on or around May 18, 2023, that some of the files acquired by the attackers included protected health information provided by its healthcare provider clients. The compromised information was limited to names, addresses, dates of birth, health insurance information, and clinical information, including diagnosis, treatment information, and/or medication information. Desert Physicians Management said additional security measures have been implemented to help prevent similar incidents from occurring in the future.

The post Atlantic General Hospital Increases Ransomware Victim Count to Almost 140,000 Individuals appeared first on HIPAA Journal.

Kannact Inc., an Albany, OR-based home care service, says it detected unauthorized access to its computer network on March 13, 2023. A third-party cybersecurity firm was engaged to investigate the incident and confirmed that the parts of the network that were accessed contained patients’ protected health information, although, at this stage of the investigation, it is unclear if patient data was viewed or copied from its systems. Kannact has received no reports at the time of providing notice to indicate any misuse of patient data.

The review of the files that could potentially have been accessed revealed they contained a range of information, which varied from individual to individual. Information potentially compromised included names in combination with one or more of the following data elements: date of birth, address, phone number, Social Security Number, driver’s license number, and health information such as medical diagnosis, treatment information, and pharmaceutical records.

Kannact said that it disabled its third-party managed file transfer software, deactivated all related API keys, and is improving its patient data ingestion process. Individuals whose Social Security and driver’s license numbers were impacted have been offered complimentary credit monitoring and identity theft protection services.

The incident was reported to the HHS’ Office for Civil Rights on June 20, 2023, as affecting up to 103,547 individuals.

Vincera Institute Falls Victim to Ransomware Attack

Vincera Institute in Philadelphia, PA, has confirmed that it fell victim to a ransomware attack on April 29, 2023. Immediate action was taken to secure its systems to prevent further unauthorized access to its network and patient information, and cybersecurity professionals were engaged to investigate the incident. In a June 20, 2023, press release, Vincera Institute said the investigation into the data breach is ongoing, but it has been determined that the threat actors behind the attack had access to parts of its network that contained patient information; however, unauthorized access to and misuse of patient data has not been detected.

The files potentially accessed in the attack included full names, addresses, phone numbers, email addresses, Social Security numbers, date of birth, medical histories and treatment records, insurance information, and other information provided by patients. Security safeguards have been enhanced in response to the incident, and monitoring processes have been improved.

The incident was reported to the HHS’ Office for Civil Rights on June 20, 2023, in four breach reports, covering Vincera Imaging LLC (5,000 individuals), Vincera Rehab LLC (5,000 individuals), Vincera Surgery Center (5,000 individuals), and Core Performance Physicians, dba Vincera Core Physicians (10,000 individuals).

The post Kannact & Vincera Institute Fall Victim to Cyberattacks appeared first on HIPAA Journal.