HIPAA Breach News

Data Breaches Reported by CareFirst Administrators, Legacy Health & Blakehurst

Posted by HIPAA Journal

CareFirst Administrators (CFA) has notified 14,538 individuals about a phishing attack on its revenue cycle management vendor, Conifer. CFA was one of several healthcare organizations to be affected by the incident. A security breach was identified by Conifer in late March, with the investigation determining several Microsoft 365 had been accessed by unauthorized individuals between March 17 and March 22, 2022. CFA was informed about the breach on June 23, 2022.

One of the compromised email accounts was determined to contain the protected health information of CFA members, including names, addresses, birth dates, Social Security numbers, health insurance information, medical information, and billing and claims information.

Conifer said it has implemented additional security measures to better protect its Microsoft 365 email environment to reduce the risk of further breaches.

Legacy Health Identifies Insider Breach

Legacy Health in Oregon has recently reported a breach of the protected health information of 7,983 patients. According to the substitute breach notice, the Privacy Office learned on July 25, 2022, that an employee had saved files containing patients’ protected health information to external devices without authorization. An internal investigation was launched, and it was determined that the employee had transferred files containing patient data to a personal storage device via external drives and email.

The employee had access to patient data suspended while the investigation was conducted. In multiple interviews, the employee was unable to provide a valid work reason for those actions. A review of the files revealed they contained patients’ names, birth dates, medical record numbers, dates of service, provider names, health insurance information, diagnosis and/or treatment information, and some Social Security numbers. Patients started to be notified on November 23, 2022.

Legacy Health does not believe patient information has been further disclosed or misused, although patients have been advised to monitor their credit reports and account statements for signs of misuse of their data. Free credit monitoring services are being offered to affected patients. Legacy Health has reinforced training with its workforce regarding appropriate uses and disclosures of patient data.

Maryland Senior Living Facility Announces Data Breach

Blakehurst, a senior living facility in Towson, MD, has recently announced that the personal and protected health information of current and former employees and patients has potentially been compromised in a cyberattack. Around February 7, 2022, unusual activity was detected in its email environment. The forensic investigation determined several employee email accounts had been subjected to unauthorized access., and on August 4, 2022, Blakehurst confirmed that the email accounts contained patient data.

The review of emails and attachments was completed on September 20, 2022, and revealed names, dates of birth, medical information, Social Security numbers, health insurance information, driver’s license numbers, and financial account numbers had potentially been compromised. Affected individuals were notified about the breach on December 6, 2022, and have been offered complimentary credit monitoring and identity theft protection services and will be covered by a $1,000,000 identity theft insurance policy. Blakehurst said it has taken steps to improve the security of its email environment to prevent similar breaches in the future.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Data Breaches Reported by CareFirst Administrators, Legacy Health & Blakehurst appeared first on HIPAA Journal.

Telehealth Websites are Transmitting Sensitive Health Information to Big Tech Firms

Posted by HIPAA Journal

The private information of visitors to telehealth websites is being shared with big tech companies without user consent due to the use of tracking code snippets on the websites, according to a recent analysis by The Markup.

The websites of 50 direct-to-consumer telehealth companies were analyzed for the presence of third-party tracking code, 49 of which were found to have tracking code that transmitted the information of visitors to third parties, including Meta/Facebook and Google.

The study follows on from an analysis of the websites of the top 100 hospitals in the United States in the summer, which revealed one-third were using tracking code on their websites that was sending data to third parties without consent, valid HIPAA authorizations, or business associate agreements. In a handful of cases, the tracking code was added behind password-protected patient portals.

The latest study of telehealth websites included sites that collect highly sensitive information from visitors, such as the personal and health information of people suffering from Substance Abuse Disorder (SAD) who are seeking treatment. In many cases, the answers to medical questionnaires were also sent to big tech firms from questions relating to that health conditions, medical histories, and drug use.

The report, jointly published by The Markup and STAT, found that 49 of the 50 sites studied transmitted the URLs that an individual had visited, with 35 sites also transferring personal information such as email addresses, phone numbers, and full names. 19 sites recorded and transmitted when the user-initiated checkout, 13 sites sent the answers to questionnaires to third parties, 11 sites sent data confirming when the user had added an item to their cart (such as a treatment plan), and 9 sites transferred the date the user created the account.

The 13 sites that sent questionnaire data were of particular concern, as the answers were to health questions. That information was sent to a variety of companies, including Meta, Google, TikTok, Bing, Snap, Twitter, LinkedIn, and Pinterest. 25 sites told big tech firms when a user had added an item such as a prescription medication to their cart or checked out with a treatment plan.

All but one of the 50 websites transferred the URLs that a user had visited on the site. The websites provide health and treatment information, so the information detailed on certain pages may be for a specific health complaint. That information is then tied to an individual or a household via an IP address. Amazon Clinic was the only website that did not share website data with third parties.

Potential HIPAA Violations

Healthcare providers are HIPAA-covered entities and disclosures of protected health information are restricted by the HIPAA Privacy Rule. SUD information is also subject to the 45 CFR Part 2 Confidentiality of Substance Use Disorder (SUD) Patient Records regulations. Recently, the HHS’ Office for Civil Rights published guidance for HIPAA-regulated entities that confirmed that the use of third-party tracking code on websites violates HIPAA if that tracking code collects and transfers protected health information (PHI) to third parties unless the third party qualifies as a business associate under HIPAA. In such cases, a HIPAA-compliant business associate agreement is required before the code can be used. If a third party is not a business associate, HIPAA-compliant patient authorizations are required before that code can be used.

HIPAA applies to healthcare providers, health plans, healthcare clearing houses, and business associates of those entities, but many of the telehealth sites studied operate in a gray area, as the websites are not run by HIPAA-regulated entities or SUD treatment providers, therefore the HIPAA and Part2 regulations do not apply, even though the data collected is the same data that would be classed as PHI or SUD records if collected by a covered entity.

The information collected through these websites is passed on to HIPAA-covered entities and entities covered by Part 2, but the websites themselves are intermediaries and are therefore not bound by HIPAA or the Part 2 regulations. For example, one website run by Cerebral Inc. collected HIPAA-covered data but is not a HIPAA-covered entity. The website passes the information to Cerebral Medical Group, P.A., which is a HIPAA-covered entity. The transfer of data to the big tech firms occurred before the transfer to the Cerebral Medical Group, P.A.

WorkIt Health provides healthcare services including SUD treatment. Its website states in its Notice of Privacy Practices (NPP) that, “You are receiving this NPP because you are or intend to receive health care services from a Workit Health Clinic… Each Workit Health Clinic together designates themselves as a single Affiliated Covered Entity (“ACE”) for purposes of compliance with HIPAA.” However, the WorkIt website had trackers from Google, Facebook, Bing, and Twitter, and transferred URLs, personal information, and answers to questionnaires. The Markup contacted WorkIt Health regarding the findings of the study and WorkIt Health removed the tracking technology from its website and initiated an investigation into the privacy breach.

Visitors to These Websites Expect Privacy

Many healthcare organizations add these tracking technologies to their websites with good intentions, as the technology can provide data that can help to improve the user experience on websites and gauge the effectiveness of marketing campaigns, but the extent to which patient information is being shared is not fully understood.

Individuals who visit these websites are unlikely to be aware that any information they provide directly through answers on web forms and medical questionnaires, and indirectly via the sites they visit, is not being kept private and confidential, and that is a big concern. Many of these sites mention HIPAA and Part 2 in their NPPs, yet the extent to which those regulations apply is unclear. The Markup notes that at least 12 of the studied companies state that they are HIPAA compliant, but that does not necessarily mean that the information provided on the site is kept private or is indeed covered by HIPAA at the point it is collected.

The study shows that there is a trade-off when using these websites. Patients get convenience, but it may come at the expense of their privacy. There is a massive gap in HIPAA, which has not been updated to account for changes in how healthcare is being provided, and there are also suggestions of deceptive privacy practices, albeit in many cases unwittingly deceiving visitors about privacy.

“Sensitive health information is being shared, inadvertently, online every day. Hospital websites, online pharmacies, and health information sites, use a variety of applications (site analytics, links to social media, advertising) that collect and share site visitors’ data, including the healthcare terms and medical conditions that the user is searching,” Ian Cohen, CEO of LOKKER told HIPAA Journal. “For example, in LOKKER’s recent research of over 170,000 websites, we identified the Meta Pixel (Facebook) on over 40% of healthcare sites. Similar data was found about data being shared with TikTok, Snapchat, Pinterest, Microsoft, and Google, as well.” Cohen went on to say, “Not only are consumers and patients unaware that their information is being collected and shared, we believe that the website owners don’t fully understand the extent to which they are sharing data back to the social networks.”

The Markup explained that its researchers did not test all webpages on the sites of the telehealth providers, so the full extent to which tracking code has been used is not known. Tracking code can also be configured differently on different web pages.

It is also unclear what the big tech firms do with the transferred data. Several big tech firms state that they do not allow targeted advertising related to health conditions, although there are ways around that by using closely related terms. Meta, for instance, claims to strip out any data it should not receive and does not provide that information to third-party advertisers. The extent to which that occurs is also unclear. Meta is the subject of several lawsuits over this very matter, some of which allege health data has been used to serve targeted ads to patients whose information was collected through the Meta Pixel code snippet.

Steps Operators of Health Websites Should Take

The HHS’ Office for Civil Rights has made clear in its recent guidance that tracking technology on websites violates HIPAA and that this issue needs to be addressed immediately. HIPAA-regulated entities are required to report any HIPAA violations related to the use of third-party tracking technologies. So far, only a few HIPAA-regulated entities have done so, despite huge numbers having added tracking code to their websites. Even if the websites are not run by HIPAA-regulated entities, the operators of those websites have a moral responsibility to protect the privacy of their visitors with respect to their sensitive health information. Ian Cohen suggests all healthcare organizations should take the following actions:

  1. Take inventory of what data your websites and apps are collecting and if you’re violating your own privacy policy, other privacy laws, or your customers’ trust
  2. Know your partners and ensure they aren’t exploiting your customers’ information
  3. Build customer privacy ‘muscle’ by forming teams that include Marketing, IT, and Legal and establish routines for better data hygiene
  4. Don’t just ask for customer consent for bad practices, re-evaluate how you want to better serve your customers and build trust with every interaction by communicating clearly

The post Telehealth Websites are Transmitting Sensitive Health Information to Big Tech Firms appeared first on HIPAA Journal.

Sturdy Memorial Hospital & North Shore Pain Management Settle Data Breach Lawsuits

Posted by HIPAA Journal

Two healthcare organizations in Massachusetts have chosen to settle class action lawsuits that were filed by patients whose protected health information was stolen in cyberattacks.

Sturdy Memorial Hospital

Sturdy Memorial Hospital in Attleboro, MA, has agreed to settle a lawsuit filed in response to a September 2021 ransomware attack, where the attackers gained access to the data of approximately 60,000 patients, such as names, addresses, dates of birth, Social Security numbers, financial information, and health information. The attackers exfiltrated patient data and threatened to release the information publicly. The hospital chose to pay the ransom.

The lawsuit – Shedd, et al. v. Sturdy Memorial Hospital Inc. – alleged the hospital had maintained patient information in a reckless manner, as the information was stored on a system vulnerable to cyberattacks and the data was not encrypted. The lawsuit alleged the hospital did not follow Federal Trade Commission guidelines and violated Massachusetts laws by delaying sending notification letters to patients for almost 4 months.

Sturdy Memorial Hospital admitted no wrongdoing and chose to settle the lawsuit to avoid ongoing legal costs. Under the terms of the settlement, class members can claim up to $375 for ordinary losses, including out-of-pocket expenses and up to three hours of lost time at $20 per hour. Claims can also be submitted for documented extraordinary losses incurred between February 9 and February 14, 2021, up to a maximum of $5,000. The settlement also includes free credit monitoring services for class members.

Class members have until January 14, 2023, to exclude themselves from or object to the settlement. Claims must be submitted by February 14, 2023. The fairness hearing is scheduled for February 16. 2023.

North Shore Pain Management

North Shore Pain Management, which operates pain management clinics in Beverley and Woburn, MA, and its vendor, Revolve I.T. Inc, have chosen to settle a class action lawsuit filed in response to an April 2020 ransomware attack.

The attackers gained access to its network and exfiltrated patient data prior to encrypting files. The AKO ransomware gang claimed to have stolen 4GB of data, and that data was leaked when the ransom wasn’t paid. The stolen data included patient names, dates of birth, health insurance information, account balances, financial information, diagnosis and treatment information, and for certain patients, ultrasound and MRI images and/or Social Security numbers. 12,472 current and former patients were affected.

North Shore Pain Management and Revolve I.T. maintain they had implemented adequate defenses to protect against cyberattacks and denied any wrongdoing. The decision was taken to settle the lawsuit to avoid further legal costs and the uncertainty of trial.

Under the terms of the settlement, a fund of $200,000 will be created to cover claims from class members for economic losses and lost time related to the data breach. Each class member may claim up to $150 for ordinary economic losses and lost time and claims up to a maximum of $1,500 are permitted for extraordinary losses. The settlement also includes 36 months of credit monitoring services or a $25 payment in lieu of the credit monitoring services and reimbursement of economic losses. Claims will be paid pro rata if the claims total exceeds $200,000.

Class members have until December 14, 2022, to exclude themselves from or object to the settlement. Claims must be submitted by January 13, 2023. The fairness hearing is scheduled for January 10, 2023.

The post Sturdy Memorial Hospital & North Shore Pain Management Settle Data Breach Lawsuits appeared first on HIPAA Journal.

Receivables Performance Management Data Breach Affects More Than 3.7 Million Individuals

Posted by HIPAA Journal

Data breaches have recently been reported by Acuity Brands in Georgia, San Gorgonio Memorial Hospital in California, and Receivables Performance Management in Washington. The latter appears to have affected more than 3.7 million individuals.

Receivables Performance Management

Receivables Performance Management (RPM) in Lynnwood, WA, a business associate of several HIPAA-covered entities, has recently started notifying individuals affected by a 2021 ransomware attack. The incident was detected on May 12, 2021, with the investigation confirming its systems were first breached on April 8, 2021. Files only started to be encrypted on May 12.

RPM said it was able to stop the attack and restore its systems within 36 hours and retained a computer forensics firm to investigate the breach and determine the nature and scope of the attack; however, it took until October 2, 2022, to determine the types of information and individuals affected. RPM said that the length of time it took to fully investigate the breach was due to the complexities of RPM’s server infrastructure. RPM said it “obtained confirmation to the best of its ability that the information is no longer in the possession of the third party(ies) associated with this incident.”

RPM said personal information was potentially compromised, including Social Security numbers. Affected individuals are being offered complimentary credit monitoring services. RPM said it is continuing to work with security experts to improve its defenses to prevent similar breaches in the future. At this stage, the number of people affected by the breach has yet to be confirmed. The breach report submitted to the Maine Attorney general indicates 3,766,573 individuals have been affected in total, with approximately 500,000 of those individuals residing in Texas. The incident is not yet appearing on the HHS’ Office for Civil Rights breach portal.

Acuity Brands

Acuity Brands, a lighting and building management firm in Georgia, has announced that unauthorized individuals had access to its network on December 7 and December 8, 2021, and exfiltrated some files. While investigating that breach, Acuity Brands discovered an earlier security breach that occurred on October 6 and October 7, 2020, and in that earlier incident, unauthorized individuals had attempted to copy files from its systems.

A review of all documents potentially accessed in both incidents was then conducted, which revealed the files contained the information of current and former employees and members of its health plan. The incident was limited to employees. No customer information was compromised.

Both incidents resulted in the exposure and possible theft of files containing names, Social Security numbers, driver’s license numbers, financial account information, and limited health information related to other aspects of an individual’s employment with Acuity, such as injury information related to workers compensation claims, or related to requests for leave under the Family and Medical Leave Act. The types of information involved varied from individual to individual. Complimentary memberships to credit monitoring services are being offered to eligible individuals. Additional safeguards have been implemented to prevent further data breaches.

The incidents have yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

San Gorgonio Memorial Hospital

San Gorgonio Memorial Hospital in Banning, CA, has started notifying certain patients about a computer intrusion and data theft incident. A security incident was detected on November 10, 2022, and prompt action was taken to isolate and shut down its systems. The forensic investigation confirmed that an unauthorized individual gained access to its network on October 29, 2022, with access confirmed as terminating on November 10. During that period of access, files were copied from its systems, and on November 14, 2022, it was confirmed that those files contained patient information.

A prompt notification was sent to the California Attorney General, although the document review and investigation are ongoing. It has been confirmed that the documents contained information such as names, addresses, birth dates, medical record numbers, visit ID numbers, health insurance information, and/or clinical information, including diagnosis and treatment information.

San Gorgonio Memorial Hospital said additional safeguards have been implemented to prevent further data breaches.  The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Receivables Performance Management Data Breach Affects More Than 3.7 Million Individuals appeared first on HIPAA Journal.

More than 623,000 Patients Affected by CommonSpirit Health Ransomware Attack

Posted by HIPAA Journal

CommonSpirit Health has confirmed that the protected health information of at least 623,774 patients was exposed and potentially stolen in its October 2022 ransomware attack. CommonSpirit Health first announced it was dealing with a cyberattack on October 4, 2022, and has been providing regular updates on its website as more information about the attack has been uncovered. The attack was detected on October 2, 2022, with the investigation confirming the attackers had access to parts of its network between September 16 and October 3.

The last update, issued on December 1, 2022, confirmed that the individuals behind the attack accessed the data of patients who had received services in the past, or affiliates of those individuals, from Franciscan Medical Group and/or Franciscan Health (Now Virginia Mason Franciscan Health) in Washington state, including patients of St. Michael Medical Center (formerly Harrison Hospital), St. Anne Hospital (formerly Highline Hospital), St. Anthony Hospital, St. Clare Hospital, St. Elizabeth Hospital, St. Francis Hospital, and St. Joseph Hospital.

The breached data included names, addresses, phone numbers, dates of birth, and internal patient IDs. CommonSpirit Health said the breach did not affect Dignity Health, Virginia Mason Medical Center, TriHealth, or Centura Health facilities.

Suncoast Skin Solutions Reports 75,992-Record Data Breach

Suncoast Skin Solutions, a Lutz, FL-based network of medical and cosmetic dermatology practices, has recently started notifying patients that were affected by a cyberattack that was detected on or around July 14, 2021. Prompt action was taken to contain the incident, and third-party forensics experts were engaged to investigate and determine the nature and scope of the security breach.

The forensic investigation concluded on October 21, 2021, and revealed files on the network that contained patient data had been accessed in the attack, but its electronic medical record system was unaffected. A preliminary review was conducted to determine the types of information affected, which was completed on November 8, 2021. That review confirmed only legacy patient data was involved.

Suncoast started sending notification letters to affected individuals on November 28, 2022. In the breach notification letter sent to the Maine Attorney General, Suncoast said the lengthy delay in issuing notification letters was due to the nature and size of the affected data. The data mining process commenced in December 2021, and took until October 2022 to be completed. Suncoast explained that in the interim, in order to comply with the HIPAA Breach Notification Rule, a media notice was issued on January 7, 2022, and a notice was put on its website about the data breach.

Names, dates of birth, clinical information, doctor’s notes, and other limited treatment information were exposed and potentially compromised. Credit monitoring services have been offered to affected individuals. The breach report submitted to the HHS’ Office for Civil Rights in July indicates 57,730 individuals were affected. The more recent notification to the Maine Attorney General indicates 75,992 were affected.

The post More than 623,000 Patients Affected by CommonSpirit Health Ransomware Attack appeared first on HIPAA Journal.

New York Ambulance Service Facing Multiple Class Action Lawsuits over Ransomware Attack

Posted by HIPAA Journal

The New York ambulance service, Empress EMS, is facing multiple class action lawsuits over a ransomware attack that was detected on July 14, 2022. The Hive ransomware group was behind the attack, and as per the group’s modus operandi, after gaining access to the network, sensitive files were stolen, then files were encrypted.

According to the breach notifications sent by Empress EMS, the unnamed ransomware actors stole files that included names, dates of birth, demographic information, diagnosis and treatment information, medical record numbers, dates of service, insurance information, prescription information, and, for a small subset of individuals, Social Security numbers. Those files were stolen on July 13, 2022. The Hive ransomware group published some of the stolen data on their data leak site, but the data was promptly removed. According to databreaches.net, which contacted the Hive group, Empress EMS paid the ransom.

The breach investigation revealed the ransomware gang first gained access to the network on or around May 26, 2022. Notification letters were sent to affected individuals on September 9, 2022. The breach was reported to the HHS’ Office for Civil Rights as affecting up to 318,558 individuals. Individuals whose Social Security numbers were exposed or stolen were offered complimentary credit monitoring services.

The latest lawsuit, filed in Manhattan Federal court on behalf of plaintiff Robert D’Agostini and similarly situated individuals, alleges negligence for failing to adequately protect patient data, breach of implied contract, and violations of New York General Business law. The lawsuit also alleges Empress EMS violated HIPAA.

The lawsuit takes issue with the length of time it took Empress EMS to identify the intrusion – almost 2 months – and the length of time it took to notify affected individuals – more than 7 weeks. The lawsuit alleges Empress EMS unreasonably delayed issuing notifications. It should be pointed out that HIPAA allows regulated entities a maximum of 60 days to issue notifications from the date of discovery of a data breach, but states that notifications should be sent without unreasonable delay.

The lawsuit also claims that key information was omitted from the breach notification letters, specifically that the Hive ransomware gang was behind the attack – a group known to steal and publicly leak stolen data. The Hive group claimed to have stolen more than 100,000 Social Security numbers, which the lawsuit points out is not “a small subset of files.”

The lawsuit claims the plaintiffs and class members have had their privacy violated, their protected health information is in the hands of hackers, their PHI has been publicly leaked, and they face an imminent and ongoing risk of fraud and identity theft. The lawsuit seeks class action status, a jury trial, actual damages (or $50 per class member, whichever is higher), treble damages, and punitive damages. The lawsuit is one of at least 4 complaints that have been filed against Empress EMS over the data breach.

The post New York Ambulance Service Facing Multiple Class Action Lawsuits over Ransomware Attack appeared first on HIPAA Journal.

COVID-19 Vaccination Statuses of 500,000 VA Employees have been Impermissibly Disclosed

Posted by HIPAA Journal

The COVID-19 vaccination statuses of approximately 500,000 Department of Veterans Affairs employees have been impermissibly disclosed. According to the VA, a spreadsheet containing employee names and their vaccination statuses was placed on SharePoint without appropriate access permissions being set and an email with a link to the spreadsheet was sent on behalf of the Veterans Health Administration (VHA) Healthcare Operations Center to VHA VISN directors, deputy network directors, administrative representatives, central office senior leaders, and healthcare ops controllers. The spreadsheet also included details of claimed religious and medical exceptions to COVID-19 vaccination.

The internal investigation conducted by the VA’s Data Breach Response Service concluded the information had been impermissibly disclosed and the spreadsheet was removed from SharePoint. The VA concluded that there was a low risk of misuse of that information.

Urology of Greater Atlanta Notifies Almost 80,000 Patients About August 2021 Data Breach

In October 2022, Urology of Greater Atlanta in Georgia reported a data breach to the HHS’ Office for Civil Rights that had affected 79,795 patients. At the time it was unclear exactly how that information was breached. Urology of Greater Atlanta has now confirmed that it was the victim of a cyberattack that was detected on August 29, 2021. According to the substitute breach notice recently added to the Urology of Greater Atlanta website, the forensic investigation revealed an unauthorized third party had access to its network between August 8, and August 29, 2021.

When the breach was detected, third-party forensics experts were engaged to investigate the breach and secure its systems. The investigation confirmed that the medical records database and billing/practice management system were not accessed; however, documents on the network were potentially viewed or obtained that included protected health information such as names, addresses, birth dates, ages, date(s) of service, patient account numbers, diagnoses and treatment information, medical histories, and similar information found in medical charts. In some cases, Social Security numbers, driver’s license numbers, or financial account information, were also exposed.

Urology of Greater Atlanta said it has been working extensively with third-party security experts to better protect its systems, and additional safeguards have now been put in place, including replacing certain components and changing remote access protocols. Notification letters are now being sent and complimentary identity theft protection services are being offered. Urology of Greater Atlanta said no evidence of misuse of patient information was identified. Urology of Greater Atlanta did not explain why it took 15 months to issue notifications.

Salud Family Health Reports Data Breach Affecting 80,000 Individuals

Salud Family Health, a Fort Lupton, CO-based Federally Qualified Health Center (FQHC) with 13 clinics in Colorado, has recently announced that an unauthorized third party gained access to its network. The intrusion was detected on September 5, 2022, and third-party computer specialists were engaged to investigate the nature and scope of the breach.

The investigation determined that files containing patient and employee information may have been viewed or stolen. The review of those files revealed they contained information such as names, Social Security numbers, driver’s license numbers, government-issued ID numbers, financial information, medical information, and health insurance information. Salud Family Health said impacted employees and patients have been offered free credit monitoring and identity fraud protection services.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, but the notification sent to the Texas Attorney General indicates up to 80,621 individuals have been affected.

Orlando Health Employee Email Account Breached

Orlando Health has recently notified 3,662 patients that some of their protected health information was stored in an employee’s email account that was accessed by an unauthorized individual. The email account was accessed between July 5, 2022, and July 13, 2022. Orlando Health said that based on the role of the employee, there was no expectation that the email account contained any patient information; however, the review of the contents of the account revealed on September 19, 2022, that emails and attachments in the account contained certain demographic and clinical information and, for certain patients, health insurance information and/or Social Security numbers.

It was not possible to tell which emails in the account were accessed or if any emails or attachments were downloaded. Notification letters started to be sent to affected individuals on November 18, 2022. The review of the emails is ongoing, and additional letters will be mailed to individuals who are later determined to have been affected. Complimentary credit monitoring and identity protection services have been offered to individuals who had their Social Security numbers exposed. Orlando Health said it is reinforcing education with its staff and is implementing additional security enhancements to its email environment.

The post COVID-19 Vaccination Statuses of 500,000 VA Employees have been Impermissibly Disclosed appeared first on HIPAA Journal.

CommonSpirit Health Says Patient Information Accessed in October 2022 Cyberattack

Posted by HIPAA Journal

CommonSpirit Health has provided an update on its October 2022 ransomware attack and has confirmed that the threat actors behind the attack accessed files containing patient information.

The attack was detected by CommonSpirit Health on October 2, 2022, and action was immediately taken to secure its network. While the attack caused disruption at its healthcare facilities due to systems being taken offline to contain the incident, CommonSpirit Health said there was no impact on clinic, patient care, and associated systems at Dignity Health, Virginia Mason Medical Center, TriHealth, or Centura Health facilities. The forensic investigation confirmed that the attackers had access to its network between September 16, 2022, and October 3, 2022.

CommonSpirit Health has now confirmed that the attackers gained access to parts of its network containing files that included the protected health information of patients of Franciscan Medical Group and Franciscan Health in Washington state, including patients that had received medical services at St. Michael Medical Center (formerly Harrison Hospital), St. Anne Hospital (formerly Highline Hospital), St. Anthony Hospital, St. Clare Hospital, St. Elizabeth Hospital, St. Francis Hospital, and St. Joseph Hospital. Those facilities are now known collectively as Virginia Mason Franciscan Health, which is an affiliated entity of CommonSpirit Health.

ComnmonSpirit Health has confirmed that the affected files contained the information of patients and their family members and caregivers, including names, addresses, phone numbers, birth dates, and unique internal patient identifiers. At this stage, no evidence has been found of attempted or actual misuse of the data stored on its systems.

CommonSpirit Health said the majority of EHRs across the CommonSpirit Health system are now back online and patient portals can now be accessed. The review of affected files is ongoing and it has yet to be confirmed how many individuals have been affected. CommonSpirit Health has recommended patients check their account statements for accuracy and should report any services or charges that were not incurred to their provider or insurance carrier.

The post CommonSpirit Health Says Patient Information Accessed in October 2022 Cyberattack appeared first on HIPAA Journal.

OCR Confirms Use of Website and Other Tracking Technologies Without a BAA is a HIPAA Violation

Posted by HIPAA Journal

The HHS’ Office for Civil Rights has issued a bulletin confirming that the use of third-party tracking technologies on websites, web applications, and mobile apps without a business associate agreement (BAA) is a HIPAA violation if the tracking technology collects and transmits individually identifiable health information. Even with a BAA in place, the use of the tracking technology may still violate the HIPAA Rules

The bulletin has been issued in response to the discovery earlier this year that Meta Pixel tracking code was being extensively used on the websites of hospitals and that the code snippet transferred data to Meta, including sensitive patient data. These privacy breaches came to light during an investigation by The Markup and STAT, which found Meta Pixel had been added to the websites of one-third of the top 100 hospitals in the United States and, in 7 cases, the code had been added to password-protected patient portals. The study was limited to the top 100 hospitals, so it is likely that hundreds of hospitals have used the code and have – in all likelihood unwittingly – transferred sensitive data to Meta/Facebook without a business associate agreement in place and without obtaining patient consent.

Following the publication of the report, several lawsuits were filed against healthcare providers over these impermissible disclosures, with some plaintiffs claiming the information disclosed on the websites of their healthcare providers had been transferred to Meta and was used to serve them targeted advertisements related to their medical conditions. The news came as a shock to healthcare providers, triggering investigations and recent data breach notifications; however, despite so the widespread use of the tracking code, only a handful of hospitals and health systems have reported the breach and have sent notifications so far. The bulletin from the HHS is likely to trigger a flurry of breach notifications as providers realize that the use of Meta Pixel and other tracking code constitutes a HIPAA violation.

What are Tracking Technologies?

Tracking technologies are commonly snippets of code that are added to websites, web applications, and mobile apps for tracking user activity, typically for determining the journeys of users while using websites and monitoring their on-site interactions. The data collected by these technologies can be analyzed and used to improve the services provided through the websites and applications and enhance the user experience, which benefits patients. While there are benefits to individuals from the use of this code, there is also considerable potential for harm to be caused, as in addition to providing a HIPAA-regulated entity with useful information, the data collected through these technologies is usually transmitted to the vendor.

For instance, if a female patient arranged an appointment on the website of a healthcare provider to discuss the termination of a pregnancy, the tracking technology on the site could be transmitted to the vendor, and subsequently disclosed to other third parties. That information could be provided to law enforcement or other third parties. Information disclosed in confidence by a patient of a website or web application could be transferred to a third party and be used for fraud, identity theft, extortion, stalking, harassment, or to promote misinformation.

In many cases, these tracking technologies are added to websites and applications without the knowledge of users, and it is often unclear how any disclosed information will be used by a vendor and to whom that transmitted information will be disclosed. These tracking technologies often use cookies and web beacons that allow individuals to be tracked across the Internet, allowing even more information to be collected about them to form detailed profiles. When tracking technologies are included in web applications, they can collect device-related information, including location data which is tied to a unique identifier for that device, through which a user could be identified.

All Tracking Technologies Must be HIPAA Compliant

There is nothing in HIPAA that prohibits the use of these tracking technologies, but the HIPAA Rules apply when third-party tracking technologies are used, if the tracking technology collects individually identifiable information that is protected under HIPAA and if it transmits that information to a third party, be that the vendor of the tracking technology or any other third-party. If the tracking technology collects any identifiers, they are classed as protected health information because the information connects the individual to the regulated entity, indicating the individual has received or will receive health care services or benefits from the regulated entity, and that relates to the individual’s past, present, or future health or health care or payment for care.

There is an elevated risk of an impermissible disclosure of PHI when tracking technology is used on patient portals or any other pages that require authentication as these pages usually have access to PHI. If tracking code is added to these pages it must be configured in a way to ensure that the code only uses and discloses PHI in compliance with the HIPAA Privacy Rule, and that any information collected is secured in a manner compliant with the HIPAA Security Rule. Tracking code on unauthenticated pages also has the potential to have access to PHI. The same applies to tracking technologies within a HIPAA-regulated entity’s mobile apps, if it collects and transmits PHI. OCR confirmed that only mobile apps offered by healthcare organizations are covered by HIPAA. HIPAA does not apply to third-party apps that are voluntarily downloaded by individuals, even if the apps collect and transmit health information.

“Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules,” explained OCR in the bulletin.

The OCR bulleting confirms that if tracking technologies are used, the provider of that code – which includes Meta Platforms (Meta Pixel) and Google (Google Analytics) – would be classed as a business associate and must enter into a business associate agreement (BAA) with the HIPAA-regulated entity before the code can be added to a website or application. The BAA must state the responsibilities of the vendor with respect to the PHI and specify the permitted uses and disclosures of that information. If the vendor will not sign a BAA, PHI cannot legally be provided to that vendor, therefore the code cannot be used or must be configured in a way that it does not collect or transmit PHI. OCR also confirmed that if a vendor states that they will strip out any identifiable information prior to saving or using the transferred data, such a disclosure to the vendor would still only be permitted if a BAA was signed and if the HIPAA Privacy Rule permits such a disclosure.

Other potential violations of HIPAA could occur. If any PHI is disclosed to a vendor, it must be in line with the organization’s privacy policy and be detailed in their Notice of Privacy Practices. It is important to note that simply stating that tracking technology is used in a notice of privacy practices is not sufficient by itself to ensure compliance. In addition to a BAA, any disclosure of PHI for a purpose not expressly permitted by the HIPAA Privacy Rule requires a HIPAA-compliant authorization from a patient, giving their consent to disclose that information. Website banners that ask a website visitor to consent to cookies and the use of web tracking technologies do not constitute valid HIPAA authorizations.

Actions HIPAA-Regulated Entities Should Take Immediately

In light of the bulletin, HIPAA-regulated entities should read it carefully to make sure they understand how HIPAA applies to tracking technologies. They should also conduct a review of any tracking technologies that they are using on their websites, web applications, or mobile apps to ensure those technologies are being used in a manner compliant with the HIPAA Rules. If they are not already, website tracking technologies must be included in a HIPAA-regulated entity’s risk analysis and risk management processes.

It is important to state that a tracking technology vendor is classed as a business associate under HIPAA, even if a BAA is not signed. As such, any disclosures to that vendor would be classed as an impermissible disclosure of PHI without a BAA in place, and the HIPAA-regulated entity would be at risk of fines and other sanctions if PHI is transmitted without a signed BAA.

If during the review a HIPAA-regulated entity discovers tracking technologies are being used in a manner not compliant with the HIPAA Rules, or have been in the past, then the HIPAA Breach Notification Rule applies. Notifications will need to be sent to OCR and the individuals whose PHI has been impermissibly disclosed.

The post OCR Confirms Use of Website and Other Tracking Technologies Without a BAA is a HIPAA Violation appeared first on HIPAA Journal.