A round-up of healthcare data breaches that have recently been reported to the HHS’ Office for Civil Rights and State Attorneys General.

Delaware Department of Health and Social Services – Database Misconfiguration

The Delaware Department of Health and Social Services, Division of Developmental Disabilities Services (DDDS) has recently discovered a misconfiguration occurred when creating new user accounts for the division’s client database. As a result of the misconfiguration, access was granted to the records of 7,074 individuals.

The misconfiguration was discovered on August 23, 2022, with the investigation confirming 159 new user accounts had been created that provided access to service recipients’ personal, identifiable information and protected health information, as well as some more detailed information. 12 cases were identified where records were actively accessed by the users, but many more records may have been passively accessed. It was not possible to determine how many records were passively accessed. As such, the decision was taken to notify all 7,074 individuals, who have been offered complimentary credit monitoring services for 12 months.

Steps have since been taken to improve security to prevent similar misconfigurations in the future. The lessons learned from the incident will be applied to the new client data management system that is currently being developed and is due to be implemented in 2023.

Country Doctor Community Clinic, WA – Hacking Incident

Country Doctor Community Clinic in Seattle, WA, announced on October 19, 2022, that hackers had gained access to its digital environment and viewed and potentially obtained files containing the protected health information of 38,751 patients.

Unusual activity was detected in its computer systems on October 6, 2022. Immediate action was taken to secure its IT systems and prevent further unauthorized access, and third-party cybersecurity experts were engaged to investigate the incident and determine the nature and scope of the attack. A review was conducted to determine the types of information that had been compromised, then up-to-date contact information had to be obtained for affected individuals. That process concluded on October 14, 2022.

Country Doctor Community Clinic said names, addresses, Social Security numbers, dates of birth, and other protected health information were potentially compromised. Credit monitoring and identity theft protection services are being offered to individuals whose Social Security numbers were exposed. Steps have also been taken to improve security to prevent similar breaches in the future.

Riverside Medical Group, NJ – Hacking Incident

Riverside Medical Group, an adult medical practice serving patients in Northern New Jersey, has discovered hackers gained access to a legacy server at its clinic in West Orange and may have viewed or obtained files containing patient data. The compromised server belonged to a provider who used it to store immunization records. No other systems were affected.

Riverside Medical Group said the breach was detected on August 3, 2022. The review of files on the server determined they contained the protected health information of 12,499 patients, including name, date of birth, address, gender, phone number, email address, immunization records, dates of immunizations, provider information, health plan information, and in limited instances, Social Security number. Riverside Medical Group said it is unaware of any actual or attempted misuse of patient information.

The Valley Hospital, NJ – Improper Disposal of Documents Containing PHI

The Valley Hospital in Ridgewood, NJ, has recently announced that the records of individuals who visited an outpatient COVID-19 testing facility have been disposed of in an improper manner, and could potentially have been accessed or obtained by unauthorized individuals.

The improper disposal incident was detected by the Valley Hospital on August 29, 2022. In its substitute breach notice, the hospital said post-COVID-19 testing instructions were discarded in a recycling bin at the testing facility, rather than being sent for shredding. The documents included the names of the providers administering COVID-19 tests and labels that included patient names, medical record numbers, location codes, and service dates.

The hospital attempted to recover the documents but was unable to retrieve them. The breach affected patients who received COVID-19 tests at the site between June 1 and September 1, 2022. Notifications have now been sent to affected individuals. It is currently unclear how many patients have been affected.

The post Hacking, Database Misconfigurations, and Improper Disposal Incidents Reported appeared first on HIPAA Journal.

The New York State Department of Financial Services (DFS) has agreed to settle an investigation of EyeMed Vision Care (EyeMed) into potential violations of the DFS Cybersecurity Regulation for $4.5 million.

EyeMed is an Ohio-based licensed health insurance company, which collects and stores sensitive consumer information as part of its business practices. EyeMed Vision Care was investigated by the DFS after EyeMed disclosed it had been the victim of a phishing attack and data breach that was discovered on July 1, 2020. An employee responded to a phishing email and disclosed credentials to a shared EyeMed mailbox that contained more than 6 years’ worth of non-public consumer information, including the information of minors, related to vision benefits enrollment and coverage. After accessing the account, malicious actors used it to send more than 2,000 phishing emails to EyeMed clients to trick them into disclosing their EyeMed login credentials. EyeMed was alerted to the breached email account when its clients complained about receiving phishing emails from EyeMed.

EyeMed’s investigation confirmed the email account had been accessed by unauthorized individuals on June 24, 2020, and continued until July 1, 2020, when the breach was discovered and access to the email account was terminated. The email account contained the information of approximately 2.1 million individuals, including the data of 98,632 New York residents.

The DFS determined that EyeMed was in violation of the DFS Cybersecurity Regulation (23 NYCRR Part 500) due to the failure to implement multi-factor authentication for its email environment. EyeMed had also failed to limit user access privileges, as nine employees shared login credentials for the affected email account. Further, EyeMed had failed to implement sufficient data retention limits on information in the email account nor had the company implemented sufficient data disposal processes. If multifactor authentication had been implemented, the data breach could have been prevented, and proper data retention and disposal practices would have lessened the severity of the data breach if it was not possible to prevent it.

Further investigation revealed EyeMed had not conducted a comprehensive risk assessment, which is one of the core requirements of the DFS cybersecurity regulation. If a risk assessment had been conducted, it would have highlighted the shared login credentials, lack of multifactor authentication, and lack of data retention/disposal policies. Those risks could then have been managed and reduced to a low and acceptable level. DFS also determined that EyeMed’s cybersecurity certifications for the calendar years 2018 through 2021 were improper.

In addition to paying the financial penalty, EyeMed has agreed to conduct a comprehensive cybersecurity risk assessment and develop a detailed action plan that describes how the risks identified in the assessment will be addressed. The risk assessment and action plan must be reviewed and approved by the DFS.

“It is critically important that consumers’ non-public information is kept safe from potential criminal activity, and DFS’s first-in-the-nation cybersecurity regulation requires New York-regulated entities to take that responsibility seriously,” said New York State Superintendent of Financial Services, Adrienne A. Harris. “This settlement demonstrates DFS’s ongoing commitment to protecting consumers while ensuring the safety and soundness of financial institutions from cyber threats.”

The phishing attack and data breach were also investigated by the Office of the New York Attorney General, which arrived at similar conclusions and fined EyeMed $600,000 in January 2022.

The post New York State Fines EyeMed $4.5 Million for Phishing Attack and 2.1M-Record Data Breach appeared first on HIPAA Journal.

Chambersburg, PA-based Keystone Health has recently announced that it fell victim to a cyberattack on August 19, 2022, which caused temporary disruption to its computer systems. Steps were immediately taken to restore the security of its systems and prevent further unauthorized access, and a third-party cybersecurity firm was engaged to investigate the breach and determine how the hackers gained access to its systems and the scope of the breach.

The forensic investigation revealed the hackers first gained access to its systems on July 28, 2022, with access terminated on August 19. During that time, files were accessed that contained patients’ protected health information, including names, Social Security numbers, and clinical information. A comprehensive review of those files confirmed they contained the information of 235,237 patients.

Law enforcement was notified about the cyberattack and all affected individuals have been notified by mail. Credit monitoring services are being offered to eligible patients. Keystone Health said it is implementing additional security measures to prevent further incidents of this nature, and employees have been provided with additional security awareness training.

Lifespire Services Provides Update on February 2022 Cyberattack

Lifespire Services, a New York-based provider of services to people with developmental disabilities, has provided an update on a security incident that was first disclosed in April 2022. The incident in question was detected on February 8, 2022, and caused disruption to its computer systems. Lifespire engaged a digital forensics company that determined that unauthorized individuals had access to its systems between January 14, 2022, and February 8, 2022, and during that time patient information may have been accessed.

A comprehensive review was conducted on all files on the compromised parts of its network, and that process took until October 7, 2022. Lifespire confirmed that the protected health information of 15,375 patients was compromised, including names, addresses, Social Security numbers, dates of birth, driver’s license numbers, passport numbers, bank account information, credit card information, medical diagnosis/treatment information, Medicare/Medicaid numbers, and health insurance information.

Lifespire said it is unaware of any instances of misuse of patient data but has offered affected individuals free access to credit monitoring and identity protection services. Policies and procedures related to network security have also been updated in response to the data breach.

Investigations into data breaches and reviews of affected files can take several weeks or months. Lifespire should be commended for issuing a notification to patients about the attack in April, even though the file review had yet to be completed. Prompt notification is a requirement of the HIPAA Breach Notification Rule and is important for patients, as it allows them to take appropriate steps to protect themselves against misuse of their information. Many healthcare organizations wait until the document review is completed before announcing a breach, which could be several months after data has been stolen.

Patient Information Potentially Compromised in Phishing Attack on Presbyterian Healthcare Services

Albuquerque, NM-based Presbyterian Healthcare Services recently said the protected health information of 2,624 patients was stored in an employee email account that was accessed by an unauthorized third party following a response to a phishing email.

The security breach was detected on July 8, 2022, with the subsequent investigation determining a single email account was accessed intermittently between March 21, 2022, and July 8, 2022. A review of the account confirmed no financial information was compromised; however, there may have been unauthorized access to names, dates of birth, Social Security numbers, medical record numbers, health insurance information, and limited clinical information related to billing, such as diagnosis codes and treatment information.

The review of the account is ongoing, but notification letters have started to be sent to affected individuals. Complimentary credit monitoring and identity theft protection services have been offered to patients whose Social Security numbers were exposed. Additional security awareness training has been provided to the workforce and email security enhancements are being implemented.

This is not the first incident of this nature to be reported by Presbyterian Healthcare Services. In August 2019, a major email breach was reported that affected 1,120,629 patients. Just over a year later, a hacking incident resulted in the exposure of the PHI of 193,223 patients.

The post 235,000 Keystone Health Patients Affected by August 2022 Cyberattack appeared first on HIPAA Journal.