A Washington therapist, Robert S. Miller LICSW, ACSW (RSM), has recently notified 640 current and former clients about a phishing incident that resulted in the exposure of some of their protected health information.

State laws require notifications to be sent to state attorneys general when there has been a breach of the private information of state residents. The notifications typically provide the minimum information about privacy breaches, but in this case, the therapist explained exactly how the phishing attack played out.

RSM had purchased an antivirus solution from the Iolo Software Company, and subsequently purchased an additional encryption program, which had disappeared from his computer. RSM was contacted by a person who claimed to be an Iolo employee who said he was aware that RSM’s computer had been hacked and requested access to clean the computer of viruses and malware. Access to the device was granted. RSM said he discovered this was a scam when the employee requested eBay cards worth $300.

As a result of this incident, that individual had access to the computer from December 2 to December 4, 2022, and potentially obtained files containing names, dates of birth, mailing addresses, email addresses, phone numbers, medical insurance ID numbers, Social Security numbers, and clinical information, which included evaluations, progress notes, mental health rating scales, and letters.

In response to this incident, RSM has taken several steps to prevent similar incidents in the future, including adopting encryption technologies, strengthening passwords, and engaging a third-party software company to review computers and remove any malware that may have been installed. Affected clients have been offered complimentary identity theft protection services.

Email Account Breach Reported by MJ Care

MJ Care, a New Berlin, WI-based provider of rehabilitation and health services, has recently notified 1,832 patients that some of their protected health information has potentially been accessed or obtained by an unauthorized individual. MJ Care did not state when the breach was detected; however, the investigation revealed the email account was accessed between May 31, 2022, and June 24, 2022.

The review of the affected email account concluded on November 2, 2022, and confirmed it contained patient names along with one or more of the following types of information: Social Security numbers, dates of birth, financial account information, credit/debit card information, biometric information, dates of service, treatment/diagnosis information, provider name, medical record numbers, patient numbers, medications, general medical information, and/or health insurance policy information. Notifications were sent to affected individuals on December 29, 2022. Complimentary credit monitoring services have been offered to patients whose Social Security numbers were exposed.

The post Phishing Attack on Washington Therapist Exposes Patients’ PHI appeared first on HIPAA Journal.

The Massachusetts-based medical device company, Insulet Corporation, has recently notified 29,000 of its Omnipod DASH customers about a recent privacy breach. A Medical Device Correction letter was recently sent to customers. Due to the importance of applying the update, a follow-up receipt acknowledgment request was sent via email on December 1, 2022.

The emails included a clickable link that directed customers to a webpage that was used for receipt verification; however, an error was made configuring that website which resulted in an impermissible disclosure of customers’ protected health information. Each customer was sent a unique URL that included their IP address, whether the customer was an Omnipod DASH user, and if they had a Personal Diabetes Manager.

Cookies and trackers embedded in the MDC acknowledgment pages transferred details of the URLs to third-party website performance and marketing partners. Insulet said the privacy violation was discovered on December 6, 2022, and all tracking technologies on the web pages were disabled to prevent further PHI exposure, and requests were sent to Insulet’s marketing partners requesting they delete the logs of the IP addresses and unique URLs.

Minnesota Department of Human Services Employee Error Impacts 4,307 Individuals

A mistake by an employee of the Minnesota Department of Human Services (DHS) has resulted in the impermissible disclosure of the protected health information of 4,307 Minnesota residents. On November 18, 2022, in response to a request from a client for a copy of their own data, the employee accidentally sent the billing statements of 4,307 individuals who were enrolled in Medical Assistance.

The investigation found no evidence to suggest the information was downloaded or misused. The patient who was sent the data notified DHS about the error and said the email would be deleted. The DHS confirmed that highly sensitive information such as Social Security Numbers, banking information, and credit card numbers were not included in the statements. Notification letters were sent to all affected individuals on January 11, 2023.

The post Tracking Code Privacy Incident Affects 29,000 Insulet Corporation Customers appeared first on HIPAA Journal.

The Dallas, TX-based home help service provider, Home Care Providers of Texas (HCPT), has recently announced that unauthorized individuals gained access to its network and used ransomware to encrypt files. The security breach was detected on June 29, 2022, when staff members were prevented from accessing files. Leading third-party cybersecurity experts were engaged to investigate the incident and determine the nature and scope of the breach and confirmed that the threat actors had access to its network between June 15, 2022, and June 29, 2022. During that time, files were exfiltrated from the network that contained names, addresses, dates of birth, Social Security numbers, treatment or diagnosis information, and medication information.

The delay in issuing notification letters was due to the lengthy process of reviewing all files potentially accessed or obtained to determine which individuals had been affected. That process was completed on November 15, 2022. Affected individuals have been advised to monitor their credit reports, accounts, and explanation of benefits statements for unauthorized activity. HCPT said steps have since been taken to augment cybersecurity.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal but has been reported to the Texas Attorney General as affecting 124,363 Texas residents.

Circles of Care, Inc. Hacking Incident Affects 61,170 Individuals

Circles of Care, a Florida-based provider of behavioral care services, has recently announced that employee and patient information was potentially compromised in a September 2022 cyberattack. Suspicious activity was detected within its network on September 21, 2022, with the investigation confirming an unauthorized third party gained access to the network on September 6, 2022.

The forensic investigation confirmed on November 29, 2022, that the unauthorized third party had access to parts of the network that contained patient and employee information such as names, dates of birth, Social Security numbers, addresses, phone numbers, driver’s license numbers, bank routing and account numbers, medical account numbers, provider names, service dates, diagnoses, and medical procedure codes. That information was potentially accessed or acquired, although, at the time of issuing notifications, no reports of misuse of that information have been received. Affected individuals have been advised to be vigilant against incidents of identity theft and fraud by reviewing their account statements and explanation of benefit forms.

The breach has been reported to the HHS’ Office for Civil Rights as affecting up to 61,170 individuals.

Community Health Network Says Tracking Technologies Impermissibly Disclosed PHI of Fishers Digestive Care Patients

Indianapolis, IN-based Community Health Network has recently announced that tracking technologies were used on the website and patient portal of its affiliated organization, Fishers Digestive Care, which resulted in patient data being impermissibly disclosed to third parties. The disclosed information included names, medical record numbers, IP addresses, appointments, insurance coverage, healthcare provider information, and conversations between individuals and others through the MyChart patient portal. The extent to which each individual was affected could not be determined and would have depended on their interactions on the website and patient portal.

Community Health Network previously reported the breach to the Office for Civil Rights as affecting up to 1.5 million patients. It is currently unclear how many Fishers Digestive Care patients have been affected, and whether they are included in the 1.5 million total.

The post Home Care Providers of Texas Announces 124K-Record Data Breach appeared first on HIPAA Journal.

West Oaks Eyecare – Ransomware Attack

West Oaks Eyecare in Texas has notified 1,045 Texas residents that a malicious actor gained access to its network and installed malware that rendered files inaccessible. The attack was detected on November 7, 2022, and steps were taken to contain the attack and secure its systems. The affected system contained billing information that was potentially accessed and obtained in the attack. The files included patients’ names along with one or more of the following types of information: address, date of birth, email address, phone number, patient ID number, Social Security number, optical scan images, exam results, insurance information, and billing information.

Notification letters were mailed to affected individuals on January 6, 2022.  Complimentary credit monitoring and identity protection services have been offered to individuals whose Social Security numbers were involved.

The Kelberman Center – Email Account Breach

The Kelberman Center, a Utica, NY-based provider of services to individuals with autism, has notified 3,501 patients about a breach of employee email accounts. Suspicious activity was detected within its email environment on November 1, 2022, with the investigation confirming that a single email account had been accessed by an unauthorized individual between October 21 and November 3, during which time emails and attachments may have been accessed or acquired.

A third-party digital forensics expert was engaged to investigate the breach and review system security and confirmed that no other systems had been accessed. A review of the email account confirmed the following types of information had been exposed: names, dates of birth, diagnoses, treatment information, and provider information. A very limited number of individuals had other information exposed and were notified if that was the case.  Notifications were mailed to affected individuals on December 30, 2022.

Quality Behavioral Health – Hacked Network Server

Quality Behavioral Health in Washington has recently reported a hacking incident to the HHS’ Office for Civil Rights that has affected 500 individuals – a number often used as a placeholder until the full extent of a data breach is known in order to meet the HIPAA Breach Notification Rule reporting requirements.

The cyberattack was detected on November 26, 2022, and steps were immediately taken to secure its network and prevent further unauthorized access. An investigation was launched to determine the nature and scope of the breach and the extent to which patient data was involved. That investigation and file review are ongoing, but it has been confirmed that its network was subject to unauthorized access between November 24 and November 26, 2022.

The exposed information included names, contact information, demographic information, Social Security numbers, driver’s license numbers, state identification card numbers, financial account information, birth dates, student, military, or passport identification numbers, health insurance information, medical histories, mental or physical conditions, medical diagnoses, and treatment information.

St. Rose Hospital – Hacking Incident with Data Theft Confirmed

St. Rose Hospital in Hayward, CA, has recently confirmed that a malicious actor gained access to its network and exfiltrated files containing patient information. Suspicious activity was detected in its computer systems on November 29, 2022, and third-party digital forensics specialists were engaged to investigate the breach. The investigation confirmed that its network was first accessed on November 18, 2022, and data theft occurred around that time.

The review of all files potentially accessed or copied revealed they contained names, Social Security numbers, dates of birth, e-mail addresses, and home addresses. St. Rose Hospital said it is unaware of any misuse of patient information, although databreaches.net has reported that data potentially related to the attack has been included in a dataset on a hacking forum. St. Rose Hospital has offered complimentary credit monitoring services to affected individuals.

Mindpath Health – Email System Breach

Community Psychiatry Management, doing business as Mindpath Health, has recently notified certain patients about a breach of its email system. Suspicious activity was identified within its email environment during a routine security audit. Third-party forensics experts were engaged to investigate the security breach and confirmed that two employee email accounts had been compromised, one in March 2022 and the other in June 2022. The forensic investigation concluded on November 15, 2022, and confirmed that protected health information may have been accessed, including patient names, addresses, Social Security numbers, dates of birth, medical diagnoses, treatment information, health insurance information, and prescription information. Mindpath health said it is unaware of any actual or attempted misuse of patient data.

Notification letters were sent to affected individuals on December 30, 2022. It is currently unclear how many individuals were affected.

Bay Bridge Administrators – Hacking Incident

Bay Bridge Administrators, an Austin, TX-based third-party administrator of insurance products, has recently announced that unauthorized individuals gained access to its network on or before August 25, 2022, and exfiltrated files on September 3, 2022.

The security breach was detected on September 5, 2022, when network disruption was experienced. Prompt action was taken to secure its network and investigate the breach, which revealed on December 5, 2022, that the stolen files included the personal information of individuals enrolled in certain employment insurance benefits that were administered by BBA for calendar year 2022. That information included names, addresses, Social Security numbers, driver’s license numbers, state identification card numbers, medical information, health insurance information, and/or dates of birth.

Affected individuals were notified on January 10, 2022, and have been offered 24 months of complimentary credit monitoring and identity protection services.

The post Round Up of Recent Hacking Incidents and Email Account Breaches appeared first on HIPAA Journal.

The Hive ransomware-as-a-service (RaasS) operation has claimed responsibility for an attack on Consulate Health Care, a Florida-based chain of 140 U.S. nursing homes. The group claims to have stolen 550 GB of data in the attack and said files were encrypted on December 3, 2022. The group posted on its leak site about the breach on January 6, 2023, and has already leaked some of the data allegedly stolen in the attack. The information stolen in the attack allegedly includes contracts, company information, employee information, and patient information such as medical records, Social Security numbers, contact information, and insurance information.

Consulate Health Care published a substitute breach notice on its website around the same time as Hive went public about the attack. In the website breach notice, Consulate Health Care claims the attack occurred at one of its (unnamed) vendors, which is still investigating the incident to determine the extent of the breach. Consulate Health Care said it is working closely with its vendor and has confirmed that the investigation is progressing as fast as possible to determine the extent to which protected health information was involved and which individuals have been affected. Consulate Health Care said, “we are providing this notice out of an abundance of caution as we value transparency.”

The Hive ransomware gang has a different view on the attack and claims no vendor was involved. Instead, a spokesperson for the group said in a conversation with databreaches.net that Consulate Health Care was attacked directly. The timing of the breach notice suggests that it refers to the same incident.

The Hive RaaS group is one of several ransomware gangs known to target the healthcare industry, including attacks on Lake Charles Memorial Health System in Louisiana which involved the data of 270,000 patients, and an attack on the New York ambulance service, Empress EMS, which affected up to 318,558 individuals. Due to the high risk of attacks, a joint cybersecurity advisory was issued by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services (HHS) in November, 2022, which includes technical information about the tactics, techniques, and procedures used by the group and indicators of compromise for network defenders.

The post Hive RaaS Gang Leaks Stolen Consulate Health Care Data appeared first on HIPAA Journal.