USV Optical, a subsidiary of U.S. Vision, has recently confirmed that the information of patients at several entities within its network has been exposed. Suspicious activity was detected within its network on May 12, 2021, with the forensic investigation confirming unauthorized individuals had access to its network for a month between April 20, 2021, and May 17, 2021. During that time, the attackers may have viewed or acquired sensitive patient data.

The breach was reported to U.S. Vision shortly after it was detected; however, at the time it was unclear which entities and patients had been affected. Nationwide Optical Group acquired or became affiliated with several U.S. Vision entities in September 2019, including Nationwide Optometry and SightCare. USV Optical started to provide administrative services to those entities around that time. Nationwide Optical Group was informed about the breach and requested U.S. Vision investigate the incident further to find out more information and recommended monitoring the dark web to determine if any sensitive data had been released. No further information was subsequently provided about any dark web detections.

On September 22, 2022, Nationwide Optical Group was informed that the review of the files on the compromised parts of the network had been completed, and it was confirmed that the following types of information had potentially been stolen: full names, dates of birth, addresses, Social Security numbers, taxpayer identification numbers, driver’s license numbers, financial account information, medical and/or treatment information, prescription medications, health insurance information, and billing and claims information. The types of information exposed varied from patient to patient.

The information provided was validated and correct contact information was obtained, allowing individual notification letters to be sent. That process was completed on October 17, 2022. Affected individuals have now been notified and have been offered complimentary credit monitoring and identity theft protection services.

Phoenix House Florida Email Accounts Compromised

Phoenix House Florida, a non-profit residential addiction treatment program provider, has recently announced that the protected health information of 6,594 patients has been exposed and potentially obtained by unauthorized individuals who gained access to certain employee email accounts.

The email accounts contained the protected health information of patients of Phoenix Programs of Florida, including names, Social Security numbers, driver’s license numbers, birth dates, credit/debit card numbers, expiry dates, and CVV codes, digitized or electronic signatures, Client IDs, medical information such as condition, treatment, or diagnosis, and health insurance information.

Phoenix House Florida did not disclose when the security breach was detected but said the email accounts were compromised between July 13, 2021, and November 1, 2021. The forensic investigation confirmed on September 2, 2022, that protected health information had been exposed, and notification letters were sent to affected individuals on October 19, 2022. No evidence was uncovered that suggested information in the email accounts was viewed or acquired. Complimentary identity theft protection services have been offered to individuals whose Social Security numbers or driver’s license numbers were involved.

The post U.S. Vision Subsidiary and Florida Addiction Treatment Center Announce 2021 Data Breaches appeared first on HIPAA Journal.

St. Luke’s Health has recently notified 16,906 patients that some of their protected health information has been exposed in a security incident at a vendor that provides consulting services. On November 5, 2021, the email accounts of two employees of Adelanto Healthcare Ventures (AHCV) were accessed by an unauthorized individual.

An investigation was launched into the incident, which initially determined no patient information had been exposed; however, a subsequent review determined the information of certain St. Luke’s Health patients was present in the email accounts and could potentially have been accessed or acquired by the attackers. The exposed information included names, addresses, dates of birth, Social Security numbers, dates of service, medical record numbers, Medicaid numbers, and some limited clinical information, such as treatment and diagnosis codes. St. Luke’s Health was notified about the breach on September 1, 2022

St. Luke’s Health explained in its breach notification letters that no reports have been received that suggest there has been any misuse of patient data; however, as a precaution, AHCV is offering affected individuals complimentary identity theft and credit monitoring services.

St. Luke’s Health is currently recovering from a ransomware attack on its parent company, CommonSpirit Health, that occurred more than a month ago. CommonSpirit Health is still facing disruption to business operations as a result of the attack but has now restored the MyChart patient portal and providers can now access their patients’ electronic medical records.

Tift Regional Health System Investigating Cyberattack and Data Breach

Tift Regional Health System (TRHS) in Tifton, GA, has recently announced that its systems have been compromised and that the attackers potentially accessed and obtained the protected health information of some of its patients. The unauthorized system access occurred on or around August 16, 2022. Prompt action was taken to secure its systems and an investigation was launched to determine the nature and scope of the attack.

TRHS said files on its systems were not encrypted, and its electronic medical record system was not accessed; however, the forensic investigation was unable to rule out unauthorized access and theft of files that contained patient information. The files on the compromised part of the network contained Social Security numbers, patient identification numbers, driver’s license numbers, medical information, treatment information, diagnosis information, health insurance information, and dates of birth.

TRHS said it is reviewing its existing policies and procedures regarding cybersecurity and additional safeguards are being evaluated to protect against this type of incident in the future. The breach has been reported to the HHS’ Office for Civil Rights as affecting 500 individuals. That number is often used as a placeholder until the full extent of the breach is known.

Wenco Management Reports Breach of Health and Welfare Benefit Plan Member Data

The protected health information of 20,526 employees of Wenco Management, LLC, has been exposed and potentially obtained by unauthorized individuals. Wenco Management operates the Wendy’s fast-food chain. Affected employees were members of its Health and Welfare Benefit Plan.

Wenco Management identified the breach on August 21, 2022. After its systems were secured, a forensic investigation was launched to determine the nature and scope of the breach, which confirmed an unauthorized individual had accessed its network and potentially viewed and obtained employee records that included names, Social Security numbers, and plan selection information. The breach occurred on the same day it was identified and blocked. Affected individuals have been offered complimentary credit monitoring services. Wenco Management said it has taken steps to improve the security of its systems to prevent further data breaches in the future.

The post St. Luke’s Health Reports Third Party Data Breach appeared first on HIPAA Journal.

The medical claims processor, CorrectCare Integrated Health, has recently notified its clients that the protected health information of some of their patients was accidentally exposed over the Internet and may have been accessed by unauthorized individuals. On July 6, 2022, CorrectCare discovered two file directories on its web server had been misconfigured and could be accessed over the Internet without authentication.

The breach has affected patients treated by Mediko, Inc. – the largest provider of health care services to individuals in correctional facilities in Virginia. Mediko has reported the breach to the HHS’ Office for Civil Rights (OCR) as affecting 2,809 individuals. Sacramento County Adult Correctional Health says 5,372 individuals have been affected, and the Louisiana Department of Public Safety and Corrections says 85,466 individuals incarcerated in facilities in the state have been affected. Health Net Federal Services (HNFS) in California, a business associate of the California Correctional Health Care Services (CCHCS)/ California Department of Corrections and Rehabilitation (CDCR), has had data exposed, although at this stage it is unclear how many individuals have been affected.

CorrectCare said the web server was secured within 9 hours of the discovery of the misconfiguration. The forensic investigation confirmed the files were exposed from January 22, 2022, to July 7, 2022. The exposed data related to individuals treated between January 1, 2012, and July 7, 2022. The files in the exposed directories included names, dates of birth, inmate numbers, and limited health information, including diagnosis codes, CPT codes, treatment providers, dates of treatment, and, for some individuals, Social Security numbers.

On October 31, 2022, CorrectCare submitted three breach reports to OCR confirming the protected health information of 496,589 individuals had been exposed. The final breach total is not yet known, but more than 590,236 individuals are now known to have been affected.

Regions Hospital Reports Hackling Incident

Regions Hospital in St. Paul, MN, has recently confirmed that unauthorized individuals gained access to the protected health information of 978 patients. The attacker is believed to have accessed its secure network to steal payments from a health insurer, rather than to obtain patient information.

However, as part of that activity, a document on the network was opened that contained patient information, including first and last names and Social Security numbers. Affected individuals have been notified by mail and offered a 12-month membership to an identity theft protection service.

The post Update: CorrectCare Integrated Health Data Breach Affects Hundreds of Thousands of Inmates appeared first on HIPAA Journal.

Several more providers of anesthesia services have confirmed they have been affected by a data breach at their management services organization (MSO). Last month, HIPAA Journal reported that 13 providers of anesthesia services to hospitals had been affected by the breach. At least five more healthcare providers are now known to have been affected. The latest announcements bring the breach total up to 410,842 records.

• Somnia Pain Mgt of Kentucky – 10,849 individuals
• Resource Anesthesiology Associates of KY PSC – 8,995
• Saddlebrook Anesthesia Services PC – 8,861 individuals
• Somnia, Inc. – 1,326 individuals
• Mid-Westchester Anesthesia Services – 707 individuals

The breach was detected by the MSO on July 11, 2022, with the forensic investigation determining information stored on its systems had been compromised. The affected companies were notified about the breach on September 22, 2022.

The breach involved names, Social Security numbers, dates of birth, driver’s license numbers, financial account information, health insurance policy numbers, medical record numbers, Medicaid/Medicare IDs, and health information, including diagnosis and treatment information.

Massengale Eye Care Affected by Eye Care Leaders’ Data Breach

Massengale Eye Care in Moore, OK, has recently announced that the protected health information of up to 15,000 patients has been compromised in a data breach at its EHR vendor, Eye Care Leaders. Massengale Eye Care said it has used the myCare Integrity electronic health records platform since 2017. On or around December 4, 2021, unauthorized individuals gained access to the platform and potentially obtained patient information.

Eye Care Leaders said it is unaware of any misuse of patient data, and no specific evidence was found to indicate the records of Massengale Eye Care patients were viewed or obtained. Since unauthorized access to protected health information could not be ruled out, notifications have been sent to affected individuals. The information potentially accessed includes names, addresses, dates of birth, Social Security numbers, diagnostic information, and health insurance information. Massengale Eye Care confirmed that the breach was confined to the Eye Care Leaders platform.

41 eye care providers are now known to have been affected and the records of at least 3,649,470 patients have been exposed.

Telehealth Vendor Announces 3-Year Data Breach

Miramar, FL-based telehealth provider, MDLIVE Medical Group, has recently announced that the protected health information of 7,439 individuals has been impermissibly disclosed as a result of a third-party analytics tool on its website. MDLIVE Medical Group did not confirm which analytics tool was involved, but similar breaches have been reported by other healthcare providers recently that involved the Meta Pixel tool, which is used for a similar purpose.

MDLIVE Medical Group said the tool was used to better understand how patients interacted on its website and patient portal, in order to make improvements to the portal to improve the quality of care provided to patients. The tool was first added to the website in June 2019 but was accidentally configured to monitor activity on the patient login page of its portal. The tool was removed in August 2022. The data disclosed to the provider of the tool included usernames, passwords, and dates of birth only. There is no indication that the information has been viewed or misused.

The post Anesthesia, Eye Care, and Telehealth Providers Announce Third-Party Data Breaches appeared first on HIPAA Journal.

University of Michigan Health (Michigan Medicine) has recently announced that the protected health information of approximately 33,850 patients has potentially been compromised in a phishing attack. Suspicious activity was detected within its email environment and steps were immediately taken to secure the accounts to prevent further unauthorized access.

Michigan Medicine said it was targeted in a phishing campaign between August 15 and August 23, 2022, and four email accounts were compromised. Michigan Medicine said in its breach notice that employee email accounts were protected with multi-factor authentication at the time of the attack. Four employees responded to the phishing emails, visited a malicious website, disclosed their Michigan Medicine login information, and responded to the multi-factor authentication prompts, which allowed their accounts to be accessed.

The forensic investigation found no evidence of data theft and it appeared that the accounts were not compromised in order to obtain patient information; however, Michigan Medicine has assumed that all information in the accounts has been compromised. The review of the email accounts was completed on October 17, 2022, and notification letters have now been mailed.

The compromised accounts contained job-related communications for the coordination and care of patients. The information in the emails varied from patient to patient and may have included names, along with one or more of the following types of information: address, date of birth, diagnostic and treatment information, and health insurance information. Michigan Medicine said it has implemented additional technical safeguards to its email system and the infrastructure that supports it to prevent further incidents of this nature.

This is the second email account breach to be reported by Michigan Medicine this year. In late February, Michigan Medicine announced that a single email account containing the PHI of 2,920 patients had been compromised. Michigan Medicine was also targeted in a phishing campaign in 2019, which saw 3,200 of its employees receive phishing emails. In that attack, three employees responded, resulting in the exposure of the PHI of 5,466 patients.

Ascension St. Vincent’s Coastal Cardiology Brunswick Suffers Ransomware Attack

Ascension St. Vincent’s Coastal Cardiology Brunswick in Georgia has started notifying 71,227 patients about a security breach that affected its legacy systems, including its legacy electronic medical record system. The incident was detected on August 15, 2022, and all systems were immediately secured to prevent further unauthorized access and; however, it was not possible to prevent the encryption of certain files on those systems. The investigation confirmed the attack was confined to its legacy systems. No Ascension networks or systems were affected, nor was the electronic medical system that is currently in use. The legacy Coastal Cardiology network was primarily used to retain patient data to meet regulatory requirements and was not used for current business operations.

Ransomware attacks often involve data theft prior to the encryption of files; however, the forensic investigation found no evidence to suggest any information was removed from those systems. The breach notice suggests the ransom was not paid, as the data could not be decrypted. As such, it was not possible to determine the exact types of information that had been encrypted. Ascension said the systems would have contained demographic and health information related to visits at Coastal Cardiology prior to October 5, 2021. That information would have included names, addresses, email addresses, phone numbers, insurance information, Social Security numbers, clinical information, and billing and insurance information.

Complimentary credit and identity theft protection services have been offered to affected individuals. Ascension said it has conducted a security risk assessment, realigned staff responsibilities, removed access rights to the legacy system, and is providing further training to its associates.

Delta Dental of Washington Members Affected by Mailing Vendor Hacking Incident

Delta Dental of Washington has announced that the protected health information of 6,361 members of its dental benefits plans has potentially been compromised in a cyberattack on its mail and printing vendor, Kaye-Smith. The attack occurred in June 2022 and resulted in the exposure of information such as names, addresses, group numbers, and Delta Dental Member ID numbers. Delta Dental of Washington was one of several organizations affected by the data breach.

Kaye-Smith is notifying affected individuals on behalf of Delta Dental of Washington and has offered complimentary credit monitoring services for 12 months.

The post PHI of Almost 34,000 Patients Potentially Compromised in Michigan Medicine Phishing Attack appeared first on HIPAA Journal.