Physicians Business Office (PBO), a Parkersburg, WV-based provider of medical practice management and administrative services, has recently disclosed a security incident that occurred in April 2022. PBO detected unusual activity within its network and took immediate steps to isolate the affected systems and prevent further unauthorized access. A third-party computer forensics company was engaged to determine the nature and scope of the breach and assist with the incident response.

The forensic investigation confirmed files were present on the compromised systems that contained the protected health information of certain individuals, including names, home addresses, dates of birth, Social Security numbers, driver’s license numbers, medical treatment and diagnosis information, disability codes, prescription information, and health insurance account information. Those files were potentially accessed and may have been copied from its systems

PBO said the review of the files on its systems took until June 30, 2022, and the affected healthcare provider clients were notified about the breach on July 26, 2022. Consent was then obtained to send notification letters on behalf of the affected healthcare provider clients, and work commenced on obtaining up-to-date contact information for the affected individuals. That process was completed on September 16, 2022, and notification letters were sent shortly thereafter. Affected individuals have been offered complimentary credit and identity monitoring services. PBO said it has now implemented additional security measures to reduce the risk of future breaches.

The data breach has been reported to the HHS’ Office for Civil Rights as affecting up to 196,573 individuals.

Data Breach Affects More than 58,500 Reelfoot Family Walk-In Clinic Patients

Dyersburg Family Walk-In Clinic, doing business as Reelfoot Family Walk-In Clinic in Dyersburg, TN, has recently notified 58,562 patients that some of their protected health information has been acquired by unauthorized individuals who gained access to its computer systems.

Suspicious activity was detected in its computer systems on July 24, 2022, and immediate action was taken to investigate and mitigate the activity. Third-party forensics specialists were engaged to investigate the breach and confirmed that the attackers had access to its systems between July 10, 2022, and August 14, 2022, and during that time certain files were exfiltrated from its systems.

The review of all files potentially accessed was completed on September 16, 2022. Reelfoot said the information that was subjected to unauthorized access included names, Social Security numbers, dates of birth, full home addresses, diagnoses, disability codes, lab results, medications, medical records, other treatment information, driver’s license numbers, financial account information, claims information, patient IDs and other identifiers, and other billings information.

Reelfoot said it is working on improving the security of its systems and will be providing further security awareness training to its workforce. Affected individuals have been offered complimentary credit monitoring services for 12 months.

The post Physicians Business Office Reports Data Breach Affecting 196,573 Individuals appeared first on HIPAA Journal.

Humana has recently announced that the protected health information of 22,767 individuals has potentially been compromised in a security incident and data breach at one of its business associates – Choice Health – which Human used to sell Medicare products on its behalf. On May 18, 2022, Choice Health learned that a Choice Health database was accessible over the Internet, with the investigation confirming the misconfiguration was caused by a third-party service provider.

An unauthorized individual gained access to the database, removed certain database files, and threatened to publicly release the stolen data. The exposed database was detected by Choice Health on May 14, 2022, with the theft of database files identified on May 18. The unauthorized access and data theft occurred on or around May 7, 2022.

Initially, it was thought that the breach was limited to Choice Health lead generation and marketing information; however, further investigations confirmed that the data of some of its carrier partners had also been compromised, including first and last names, Social Security numbers, Medicare beneficiary identification numbers, dates of birth, addresses, other contact information, and health insurance information.

Choice Health worked with its service provider to ensure the database was secured and additional data security measures have been implemented to prevent similar occurrences in the future. Complimentary memberships to credit monitoring and identity theft protection services have been offered to affected individuals.

Tessie Cleveland Community Services Corp Reports Email Account Breach

The Los Angeles, CA-based mental health clinic, Tessie Cleveland Community Services Corp (TCCSC), has recently announced that an unauthorized third party gained access to the email accounts of some of its employees and potentially viewed or obtained the protected health information of patients.

TCCSC identified the unauthorized access on July 20, 2022, and, assisted by a cybersecurity firm, it was confirmed that the email accounts were compromised between June 17, 2022, and June 30, 2022. The investigation suggested the attackers were not interested in obtaining patient information, rather this was an attempted business email compromise attack to commit business fraud against TCCSC; however, the theft of patient data could not be ruled out.

The review of the compromised email accounts confirmed they contained information such as names, demographic information, health insurance identification numbers, limited information regarding care at Tessie, and in some instances, Social Security numbers. Up to 9,747 patients have been notified that their information has been exposed. Credit monitoring services have been offered to eligible individuals.

Email Accounts Breached at Easterseals-Goodwill Northern Rocky Mountain

Easterseals-Goodwill Northern Rocky Mountain, a Great Falls, MT-based provider of services to children and adults with disabilities, has announced a breach of eight employee email accounts and the exposure of the protected health information of 3,886 patients.

Easterseals-Goodwill did not state in its notification letters when the unauthorized access was discovered but said the forensic investigation concluded on July 20, 2022, and determined the email accounts were accessed by an unauthorized individual between October 12, 2021, and November 11, 2021. The email accounts contained names, Social Security numbers, and other personal information, but did not involve its marketing email subscriber list, store transaction information, or donor information.

Notifications were sent to affected individuals on September 16, 2022. Complimentary credit monitoring services have been offered to individuals who had their Social Security numbers exposed. Internal controls have been augmented to prevent similar breaches in the future.

The post Humana Members Impacted by Choice Health Data Breach appeared first on HIPAA Journal.

Wolfe Clinic, P.C in Iowa has recently confirmed that it was affected by the data breach at the electronic medical record provider, Eye Care Leaders. The attack exposed the protected health information of 542,776 current and former Wolfe Clinic patients.

Wolfe Clinic used the myCare Integrity medical records platform, which was accessed by an unauthorized party on or around December 4, 2021, who deleted databases and system configuration files. A forensic investigation of the security incident was conducted but the deletion of files meant there was a lack of forensic evidence, so it was not possible to determine whether the PHI of Wolfe Clinic patients was accessed or acquired in the attack. Wolfe Clinic said names, addresses, birth dates, Social Security numbers, diagnostic information, and health insurance information were potentially compromised.

At the time of issuing notifications, Wolfe Clinic had not received any reports of identity theft and fraud related to the Eye Care Leaders data breach. Affected individuals have been offered 12 months of complimentary credit monitoring and identity theft protection services.

The Eye Care Leaders data breach is known to have affected at least 40 eye care providers and resulted in the exposure of the PHI of at least 3.6 million patients.

Reiter Affiliated Companies Reports June 2022 Cyberattack

Reiter Affiliated Companies, the largest fresh, multi-berry producer in the world, has recently confirmed that an unauthorized third party gained access to its network between June 25, 2022, and July 4, 2022. The attack was detected on July 4, 2022, when certain systems were made unavailable. Prompt action was taken to secure its systems to prevent further unauthorized access, and an investigation was launched to determine the nature and scope of the attack. The forensic investigation confirmed that files had been exfiltrated from its systems during the period of unauthorized access, and those files included Health and Wellness Plan enrollment rosters that contained plan member names, dates of birth, and Social Security numbers.

Affected individuals have been notified by mail and have been offered complimentary credit monitoring and identity theft protection services. Reiter Affiliated Companies said steps have been taken to improve security to prevent further data breaches in the future.

The breach has been reported to the HHS’ Office for Civil Rights by Reiter Affiliated Companies, LLC as affecting 45,000 individuals, and by the Reiter Affiliated Health and Welfare Plan as affecting 45,000 individuals.

SERV Behavioral Health System Confirms May 2022 Cyberattack

SERV Behavioral Health System in New Jersey has recently announced that it was the victim of a cyberattack in which the protected health information of 8,110 individuals was potentially compromised. The health system said the attack was detected on May 27, 2022, with the forensic analysis concluding on August 4, 2022. SERV said it found no evidence that any patient information was viewed or obtained in the attack, but it was not possible to rule out the possibility of data theft. The review of all files potentially accessed included names, contact information, Social Security numbers, driver’s license numbers, and health information.

Affected individuals have now been notified by mail and steps have been taken to improve security to prevent further attacks of this nature. The Hive ransomware gang claimed responsibility for the attack.

The post Cyberattacks Reported by Wolfe Clinic, Reiter Affiliated Companies, & SERV Behavioral Health System appeared first on HIPAA Journal.

Lubbock Heart & Surgical Hospital in Texas has recently announced it was the victim of a hacking incident that resulted in disruption to the operations of some of its IT systems. The cyberattack was detected by the hospital on July 12, 2022, and immediate action was taken to contain the incident and prevent further unauthorized access, and forensics experts were engaged to determine the nature and scope of the attack. The investigation confirmed its systems were accessed by the attackers between July 11 and July 12, but it was not possible to determine if any files containing patient information had been accessed or copied from its systems.

The files potentially accessed included patient information such as names, contact information, demographic information, dates of birth, Social Security numbers, diagnosis and treatment information, prescription information, medical record numbers, provider names, dates of service, and health insurance information.

Lubbock Heart & Surgical Hospital said security safeguards and technical measures have been enhanced to prevent further security incidents. Notification letters were sent to the 23,379 affected individuals on September 9, 2022. Complimentary credit monitoring and identity theft protection services have been offered to individuals who had their Social Security numbers exposed.

NorthStar Healthcare Consulting Data Breach Affects 18,354 Patients

Alpharetta, GA-based NorthStar Healthcare Consulting, a business associate supporting Optum Rx, which provides pharmacy benefit management services to the Georgia Department of Community Health, Medical Assistance Plans Division, has reported a breach of an employee email account and the exposure of sensitive patient information.

According to the breach notice submitted to the Vermont Attorney General, suspicious activity was detected in the email account on April 20, 2022. Third-party forensic investigators were engaged to investigate the incident which confirmed the email account had been accessed by an unauthorized individual, but it was not possible to confirm which, if any, emails containing protected health information had been accessed, or if emails had been copied. The investigation concluded on July 15, 2022, and work began on obtaining up-to-date contact information to issue notifications.

NorthStar Healthcare Consulting said the emails contained names, addresses, birth dates, Medicaid numbers, medication names, prescriber names, and appeal numbers, and for a limited number of patients, brief notes on diagnosis and related symptoms. NorthStar Healthcare Consulting said steps have been taken to improve email security and complimentary credit monitoring and identity theft protection services have been offered to affected individuals.

The incident has been reported to the HHS’ Office for Civil Rights as affecting 18,354 individuals.

The post Lubbock Heart & Surgical Hospital and NorthStar Healthcare Consulting Disclose Cyberattacks appeared first on HIPAA Journal.

The Physicians’ Spine and Rehabilitation Specialists of Georgia (PSRSG) has notified 38,765 patients that some of their protected health information has potentially been compromised in a cyberattack that occurred on or around July 11, 2022. A team of external cybersecurity experts was engaged to assist with the investigation and remediation efforts, and its systems were successfully restored within a few days without causing any material delays to clinical care.

PSRSG said numerous security measures had been implemented prior to the attack, but the attackers were able to circumvent those defenses. Steps have since been taken to enhance security to prevent similar breaches in the future. The forensic investigation confirmed the attacker had access to its systems for around a week before the intrusion was detected and blocked.

It was not possible to determine which files were accessed or if any sensitive information was stolen in the attack, but the attacker claimed to have stolen sensitive data from its systems and threatened to release that information publicly. A review of the files on the compromised systems confirmed they contained protected health information, which included names, birth dates, contact information, Social Security numbers, driver’s license numbers, treatment information, guarantor information, and insurance information. The types of data in the files varied from individual to individual. PSRSG said affected individuals have been notified and offered free credit monitoring and identity theft insurance through Experian, “solely to give patients peace of mind.”

One Medical, Inc. Confirms Hacking Incident and Potential Data Breach

The Sherman, TX-based healthcare provider, One Medical Inc., has recently confirmed that it was the victim of a cyberattack in which names, addresses, medical information, and Social Security numbers were potentially compromised. The data breach was reported to the Attorney General of Texas on September 9, 2022, as a hacking incident. Limited information is currently available, but the breach appears to have affected at least 964 Texas residents.

This is the second data breach to have hit the firm in the past year or so. In July 2021, One Medical reported an email error in which the PHI of 1,009 individuals was impermissibly disclosed.

The post Data Breaches Reported by Physicians’ Spine and Rehabilitation Specialists of Georgia and One Medical Inc. appeared first on HIPAA Journal.

The New York Ambulance Service, Empress EMS (Emergency Medical Services), has confirmed it was the victim of a ransomware attack. The attack was detected on July 14, 2022, and resulted in files on certain systems being encrypted. According to the company’s website notification, steps were immediately taken to contain the incident and third-party forensics experts were engaged to investigate the attack.

The forensic investigation revealed the attackers first gained access to its network on May 26, 2022, and copied “a small subset of files “on July 13, 2022. Ransomware was then deployed to encrypted files on the network. A comprehensive review of the affected files confirmed they contained protected health information such as names, insurance information, dates of service, and, for some individuals, Social Security numbers. Empress EMS has reported the data breach to the HHS’ Office for Civil Rights as affecting up to 318,558 patients. Empress EMS has notified all affected individuals and has advised them to monitor their healthcare statements for accuracy and said credit monitoring services will be offered to certain individuals.  Empress EMS said steps have been taken to strengthen system security to prevent similar incidents in the future.

Empress EMS did not confirm which group was behind the attack; however, the Hive ransomware gang has claimed responsibility for the attack. Databreaches.net obtained a copy of the ransom note and a sample of the stolen data and reports that the files appear to contain the protected health information of Empress EMS patients. The Hive gang claims to have obtained the Social Security numbers of more than 100,000 patients, and customer information such as email addresses, addresses, passport numbers, phone numbers, payments, and working hours. Employee data was also compromised, along with contracts, NDAs, and other private company information.

At the time of publication, the stolen data is not listed on the Hive group’s data leak site, although some data was briefly uploaded. Typically, if the ransom is not paid the group follows through on its threat and publishes the stolen data.

The post New York Ambulance Service Discloses Ransomware Attack and 318K-Record Data Breach appeared first on HIPAA Journal.