HIPAA Breach News

Up to 254,000 Medicare Beneficiaries Affected by Ransomware Attack on CMS Subcontractor

Posted by HIPAA Journal

On November 14, 2022, Fairmont, WV-based Health Care Management Solutions (HMS) reported a data breach to the HHS’ Office for Civil Rights that affected up to 500,000 individuals. At the time, few details about the breach were released. It has now been confirmed that HMS suffered a ransomware attack on October 8, 2022.

HMS is a subcontractor of ASRC Federal Data Solutions, LLC (ASRC Federal), which is a business associate of the HHS’ Centers for Medicare and Medicaid Services (CMS). The services provided include resolving system errors related to beneficiary entitlement and premium payment records, as well as supporting the collection of Medicare premiums from the direct-paying beneficiary population.

The CMS said the HMS does not handle Medicare claims information so no claims data was affected and CMS systems were not breached; however, the cybercriminals behind the attack may have accessed Medicare beneficiaries’ personally identifiable information (PII) and/or protected health information (PHI). The CMS says up to 254,000 Medicare beneficiaries have potentially been affected and had some of their PII and PHI exposed.

The information exposed and potentially stolen in the attack included names, addresses, birth dates, phone numbers, Social Security numbers, Medicare beneficiary identifiers, banking information, and Medicare entitlement, enrollment, and premium information. The CMS is issuing notification letters to affected Medicare beneficiaries and said they will be issued with updated Medicare cards with new beneficiary identifiers. Complimentary credit monitoring services are being provided.

HMS notified the CMS about the ransomware attack on October 9, 2022, and on October 18, 2022, the CMS determined with a high degree of confidence that Medicare beneficiary information was involved. Since that date, the CMS has been working with its contractor to determine which individuals were affected. The CMS investigation into the ransomware attack is ongoing, but the initial information indicates HMS acted in violation of its obligations to CMS. The CMS said it is unaware of any attempted or actual misuse of the PII and PHI of Medicare beneficiaries.

“The safeguarding and security of beneficiary information is of the utmost importance to this Agency,” said CMS Administrator Chiquita Brooks-LaSure. “We continue to assess the impact of the breach involving the subcontractor, facilitate support to individuals potentially affected by the incident, and will take all necessary actions needed to safeguard the information entrusted to CMS.”

The post Up to 254,000 Medicare Beneficiaries Affected by Ransomware Attack on CMS Subcontractor appeared first on HIPAA Journal.

Up to 254,000 Medicare Beneficiaries Affected by Ransomware Attack on CMS Subcontractor

Posted by HIPAA Journal

On November 14, 2022, Fairmont, WV-based Health Care Management Solutions (HMS) reported a data breach to the HHS’ Office for Civil Rights that affected up to 500,000 individuals. At the time, few details about the breach were released. It has now been confirmed that HMS suffered a ransomware attack on October 8, 2022.

HMS is a subcontractor of ASRC Federal Data Solutions, LLC (ASRC Federal), which is a business associate of the HHS’ Centers for Medicare and Medicaid Services (CMS). The services provided include resolving system errors related to beneficiary entitlement and premium payment records, as well as supporting the collection of Medicare premiums from the direct-paying beneficiary population.

The CMS said the HMS does not handle Medicare claims information so no claims data was affected and CMS systems were not breached; however, the cybercriminals behind the attack may have accessed Medicare beneficiaries’ personally identifiable information (PII) and/or protected health information (PHI). The CMS says up to 254,000 Medicare beneficiaries have potentially been affected and had some of their PII and PHI exposed.

The information exposed and potentially stolen in the attack included names, addresses, birth dates, phone numbers, Social Security numbers, Medicare beneficiary identifiers, banking information, and Medicare entitlement, enrollment, and premium information. The CMS is issuing notification letters to affected Medicare beneficiaries and said they will be issued with updated Medicare cards with new beneficiary identifiers. Complimentary credit monitoring services are being provided.

HMS notified the CMS about the ransomware attack on October 9, 2022, and on October 18, 2022, the CMS determined with a high degree of confidence that Medicare beneficiary information was involved. Since that date, the CMS has been working with its contractor to determine which individuals were affected. The CMS investigation into the ransomware attack is ongoing, but the initial information indicates HMS acted in violation of its obligations to CMS. The CMS said it is unaware of any attempted or actual misuse of the PII and PHI of Medicare beneficiaries.

“The safeguarding and security of beneficiary information is of the utmost importance to this Agency,” said CMS Administrator Chiquita Brooks-LaSure. “We continue to assess the impact of the breach involving the subcontractor, facilitate support to individuals potentially affected by the incident, and will take all necessary actions needed to safeguard the information entrusted to CMS.”

The post Up to 254,000 Medicare Beneficiaries Affected by Ransomware Attack on CMS Subcontractor appeared first on HIPAA Journal.

OCR Fines California Dental Practice for PHI Disclosures on Yelp

Posted by HIPAA Journal

The HHS’ Office for Civil Rights (OCR) has announced a settlement has been reached with a Californian dental practice to resolve multiple HIPAA violations that were identified during investigations of a complaint about impermissible disclosures of protected health information on the review platform Yelp.

New Vision Dental is a Californian general dental practice with offices in South Pasadena and Glendora. On November 29, 2017, OCR received a complaint alleging Dr. Brandon Au, owner and CEO of New Vision Dental, had posted responses to several reviews by patients on Yelp and frequently disclosed protected health information in the responses. In some of the posts, patients were identified and their full names were disclosed, when they had chosen to only use a moniker on the platform. Other information allegedly posted by Dr. Au included detailed information about the patients’ visits, treatment, and insurance, when that information had not been posted publicly by the patients.

The investigation into the impermissible disclosures also included an on-site visit to New Vision Dental. OCR’s investigators were able to confirm that Dr. Au had impermissibly disclosed the protected health information of patients on multiple occasions on Yelp, that the practice did not have the required content in its Notice of Privacy Practices, and had not implemented appropriate policies and procedures concerning protected health information, including the release of protected health information on social media platforms and in public places.

New Vision Dental chose to settle the case and paid a $23,000 financial penalty, has agreed to adopt a corrective action plan to address the aspects of non-compliance identified by OCR, and will be subject to monitoring by OCR for a period of two years.

“This latest enforcement action demonstrates the importance of following the law even when you are using social media.  Providers cannot disclose [the] protected health information of their patients when responding to negative online reviews. This is a clear NO.,” said OCR Director, Melanie Fontes Rainer. “OCR is sending a clear message to regulated entities that they must appropriately safeguard patients’ protected health information. We take complaints about potential HIPAA violations seriously, no matter how large or small the organization.”

This is the 21st financial penalty to be imposed by OCR in 2022 to resolve HIPAA violations – more than in any other year since OCR was given the authority to enforce HIPAA compliance.

The post OCR Fines California Dental Practice for PHI Disclosures on Yelp appeared first on HIPAA Journal.

Data Breaches Reported by CareFirst Administrators, Legacy Health & Blakehurst

Posted by HIPAA Journal

CareFirst Administrators (CFA) has notified 14,538 individuals about a phishing attack on its revenue cycle management vendor, Conifer. CFA was one of several healthcare organizations to be affected by the incident. A security breach was identified by Conifer in late March, with the investigation determining several Microsoft 365 had been accessed by unauthorized individuals between March 17 and March 22, 2022. CFA was informed about the breach on June 23, 2022.

One of the compromised email accounts was determined to contain the protected health information of CFA members, including names, addresses, birth dates, Social Security numbers, health insurance information, medical information, and billing and claims information.

Conifer said it has implemented additional security measures to better protect its Microsoft 365 email environment to reduce the risk of further breaches.

Legacy Health Identifies Insider Breach

Legacy Health in Oregon has recently reported a breach of the protected health information of 7,983 patients. According to the substitute breach notice, the Privacy Office learned on July 25, 2022, that an employee had saved files containing patients’ protected health information to external devices without authorization. An internal investigation was launched, and it was determined that the employee had transferred files containing patient data to a personal storage device via external drives and email.

The employee had access to patient data suspended while the investigation was conducted. In multiple interviews, the employee was unable to provide a valid work reason for those actions. A review of the files revealed they contained patients’ names, birth dates, medical record numbers, dates of service, provider names, health insurance information, diagnosis and/or treatment information, and some Social Security numbers. Patients started to be notified on November 23, 2022.

Legacy Health does not believe patient information has been further disclosed or misused, although patients have been advised to monitor their credit reports and account statements for signs of misuse of their data. Free credit monitoring services are being offered to affected patients. Legacy Health has reinforced training with its workforce regarding appropriate uses and disclosures of patient data.

Maryland Senior Living Facility Announces Data Breach

Blakehurst, a senior living facility in Towson, MD, has recently announced that the personal and protected health information of current and former employees and patients has potentially been compromised in a cyberattack. Around February 7, 2022, unusual activity was detected in its email environment. The forensic investigation determined several employee email accounts had been subjected to unauthorized access., and on August 4, 2022, Blakehurst confirmed that the email accounts contained patient data.

The review of emails and attachments was completed on September 20, 2022, and revealed names, dates of birth, medical information, Social Security numbers, health insurance information, driver’s license numbers, and financial account numbers had potentially been compromised. Affected individuals were notified about the breach on December 6, 2022, and have been offered complimentary credit monitoring and identity theft protection services and will be covered by a $1,000,000 identity theft insurance policy. Blakehurst said it has taken steps to improve the security of its email environment to prevent similar breaches in the future.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Data Breaches Reported by CareFirst Administrators, Legacy Health & Blakehurst appeared first on HIPAA Journal.

Telehealth Websites are Transmitting Sensitive Health Information to Big Tech Firms

Posted by HIPAA Journal

The private information of visitors to telehealth websites is being shared with big tech companies without user consent due to the use of tracking code snippets on the websites, according to a recent analysis by The Markup.

The websites of 50 direct-to-consumer telehealth companies were analyzed for the presence of third-party tracking code, 49 of which were found to have tracking code that transmitted the information of visitors to third parties, including Meta/Facebook and Google.

The study follows on from an analysis of the websites of the top 100 hospitals in the United States in the summer, which revealed one-third were using tracking code on their websites that was sending data to third parties without consent, valid HIPAA authorizations, or business associate agreements. In a handful of cases, the tracking code was added behind password-protected patient portals.

The latest study of telehealth websites included sites that collect highly sensitive information from visitors, such as the personal and health information of people suffering from Substance Abuse Disorder (SAD) who are seeking treatment. In many cases, the answers to medical questionnaires were also sent to big tech firms from questions relating to that health conditions, medical histories, and drug use.

The report, jointly published by The Markup and STAT, found that 49 of the 50 sites studied transmitted the URLs that an individual had visited, with 35 sites also transferring personal information such as email addresses, phone numbers, and full names. 19 sites recorded and transmitted when the user-initiated checkout, 13 sites sent the answers to questionnaires to third parties, 11 sites sent data confirming when the user had added an item to their cart (such as a treatment plan), and 9 sites transferred the date the user created the account.

The 13 sites that sent questionnaire data were of particular concern, as the answers were to health questions. That information was sent to a variety of companies, including Meta, Google, TikTok, Bing, Snap, Twitter, LinkedIn, and Pinterest. 25 sites told big tech firms when a user had added an item such as a prescription medication to their cart or checked out with a treatment plan.

All but one of the 50 websites transferred the URLs that a user had visited on the site. The websites provide health and treatment information, so the information detailed on certain pages may be for a specific health complaint. That information is then tied to an individual or a household via an IP address. Amazon Clinic was the only website that did not share website data with third parties.

Potential HIPAA Violations

Healthcare providers are HIPAA-covered entities and disclosures of protected health information are restricted by the HIPAA Privacy Rule. SUD information is also subject to the 45 CFR Part 2 Confidentiality of Substance Use Disorder (SUD) Patient Records regulations. Recently, the HHS’ Office for Civil Rights published guidance for HIPAA-regulated entities that confirmed that the use of third-party tracking code on websites violates HIPAA if that tracking code collects and transfers protected health information (PHI) to third parties unless the third party qualifies as a business associate under HIPAA. In such cases, a HIPAA-compliant business associate agreement is required before the code can be used. If a third party is not a business associate, HIPAA-compliant patient authorizations are required before that code can be used.

HIPAA applies to healthcare providers, health plans, healthcare clearing houses, and business associates of those entities, but many of the telehealth sites studied operate in a gray area, as the websites are not run by HIPAA-regulated entities or SUD treatment providers, therefore the HIPAA and Part2 regulations do not apply, even though the data collected is the same data that would be classed as PHI or SUD records if collected by a covered entity.

The information collected through these websites is passed on to HIPAA-covered entities and entities covered by Part 2, but the websites themselves are intermediaries and are therefore not bound by HIPAA or the Part 2 regulations. For example, one website run by Cerebral Inc. collected HIPAA-covered data but is not a HIPAA-covered entity. The website passes the information to Cerebral Medical Group, P.A., which is a HIPAA-covered entity. The transfer of data to the big tech firms occurred before the transfer to the Cerebral Medical Group, P.A.

WorkIt Health provides healthcare services including SUD treatment. Its website states in its Notice of Privacy Practices (NPP) that, “You are receiving this NPP because you are or intend to receive health care services from a Workit Health Clinic… Each Workit Health Clinic together designates themselves as a single Affiliated Covered Entity (“ACE”) for purposes of compliance with HIPAA.” However, the WorkIt website had trackers from Google, Facebook, Bing, and Twitter, and transferred URLs, personal information, and answers to questionnaires. The Markup contacted WorkIt Health regarding the findings of the study and WorkIt Health removed the tracking technology from its website and initiated an investigation into the privacy breach.

Visitors to These Websites Expect Privacy

Many healthcare organizations add these tracking technologies to their websites with good intentions, as the technology can provide data that can help to improve the user experience on websites and gauge the effectiveness of marketing campaigns, but the extent to which patient information is being shared is not fully understood.

Individuals who visit these websites are unlikely to be aware that any information they provide directly through answers on web forms and medical questionnaires, and indirectly via the sites they visit, is not being kept private and confidential, and that is a big concern. Many of these sites mention HIPAA and Part 2 in their NPPs, yet the extent to which those regulations apply is unclear. The Markup notes that at least 12 of the studied companies state that they are HIPAA compliant, but that does not necessarily mean that the information provided on the site is kept private or is indeed covered by HIPAA at the point it is collected.

The study shows that there is a trade-off when using these websites. Patients get convenience, but it may come at the expense of their privacy. There is a massive gap in HIPAA, which has not been updated to account for changes in how healthcare is being provided, and there are also suggestions of deceptive privacy practices, albeit in many cases unwittingly deceiving visitors about privacy.

“Sensitive health information is being shared, inadvertently, online every day. Hospital websites, online pharmacies, and health information sites, use a variety of applications (site analytics, links to social media, advertising) that collect and share site visitors’ data, including the healthcare terms and medical conditions that the user is searching,” Ian Cohen, CEO of LOKKER told HIPAA Journal. “For example, in LOKKER’s recent research of over 170,000 websites, we identified the Meta Pixel (Facebook) on over 40% of healthcare sites. Similar data was found about data being shared with TikTok, Snapchat, Pinterest, Microsoft, and Google, as well.” Cohen went on to say, “Not only are consumers and patients unaware that their information is being collected and shared, we believe that the website owners don’t fully understand the extent to which they are sharing data back to the social networks.”

The Markup explained that its researchers did not test all webpages on the sites of the telehealth providers, so the full extent to which tracking code has been used is not known. Tracking code can also be configured differently on different web pages.

It is also unclear what the big tech firms do with the transferred data. Several big tech firms state that they do not allow targeted advertising related to health conditions, although there are ways around that by using closely related terms. Meta, for instance, claims to strip out any data it should not receive and does not provide that information to third-party advertisers. The extent to which that occurs is also unclear. Meta is the subject of several lawsuits over this very matter, some of which allege health data has been used to serve targeted ads to patients whose information was collected through the Meta Pixel code snippet.

Steps Operators of Health Websites Should Take

The HHS’ Office for Civil Rights has made clear in its recent guidance that tracking technology on websites violates HIPAA and that this issue needs to be addressed immediately. HIPAA-regulated entities are required to report any HIPAA violations related to the use of third-party tracking technologies. So far, only a few HIPAA-regulated entities have done so, despite huge numbers having added tracking code to their websites. Even if the websites are not run by HIPAA-regulated entities, the operators of those websites have a moral responsibility to protect the privacy of their visitors with respect to their sensitive health information. Ian Cohen suggests all healthcare organizations should take the following actions:

  1. Take inventory of what data your websites and apps are collecting and if you’re violating your own privacy policy, other privacy laws, or your customers’ trust
  2. Know your partners and ensure they aren’t exploiting your customers’ information
  3. Build customer privacy ‘muscle’ by forming teams that include Marketing, IT, and Legal and establish routines for better data hygiene
  4. Don’t just ask for customer consent for bad practices, re-evaluate how you want to better serve your customers and build trust with every interaction by communicating clearly

The post Telehealth Websites are Transmitting Sensitive Health Information to Big Tech Firms appeared first on HIPAA Journal.

Sturdy Memorial Hospital & North Shore Pain Management Settle Data Breach Lawsuits

Posted by HIPAA Journal

Two healthcare organizations in Massachusetts have chosen to settle class action lawsuits that were filed by patients whose protected health information was stolen in cyberattacks.

Sturdy Memorial Hospital

Sturdy Memorial Hospital in Attleboro, MA, has agreed to settle a lawsuit filed in response to a September 2021 ransomware attack, where the attackers gained access to the data of approximately 60,000 patients, such as names, addresses, dates of birth, Social Security numbers, financial information, and health information. The attackers exfiltrated patient data and threatened to release the information publicly. The hospital chose to pay the ransom.

The lawsuit – Shedd, et al. v. Sturdy Memorial Hospital Inc. – alleged the hospital had maintained patient information in a reckless manner, as the information was stored on a system vulnerable to cyberattacks and the data was not encrypted. The lawsuit alleged the hospital did not follow Federal Trade Commission guidelines and violated Massachusetts laws by delaying sending notification letters to patients for almost 4 months.

Sturdy Memorial Hospital admitted no wrongdoing and chose to settle the lawsuit to avoid ongoing legal costs. Under the terms of the settlement, class members can claim up to $375 for ordinary losses, including out-of-pocket expenses and up to three hours of lost time at $20 per hour. Claims can also be submitted for documented extraordinary losses incurred between February 9 and February 14, 2021, up to a maximum of $5,000. The settlement also includes free credit monitoring services for class members.

Class members have until January 14, 2023, to exclude themselves from or object to the settlement. Claims must be submitted by February 14, 2023. The fairness hearing is scheduled for February 16. 2023.

North Shore Pain Management

North Shore Pain Management, which operates pain management clinics in Beverley and Woburn, MA, and its vendor, Revolve I.T. Inc, have chosen to settle a class action lawsuit filed in response to an April 2020 ransomware attack.

The attackers gained access to its network and exfiltrated patient data prior to encrypting files. The AKO ransomware gang claimed to have stolen 4GB of data, and that data was leaked when the ransom wasn’t paid. The stolen data included patient names, dates of birth, health insurance information, account balances, financial information, diagnosis and treatment information, and for certain patients, ultrasound and MRI images and/or Social Security numbers. 12,472 current and former patients were affected.

North Shore Pain Management and Revolve I.T. maintain they had implemented adequate defenses to protect against cyberattacks and denied any wrongdoing. The decision was taken to settle the lawsuit to avoid further legal costs and the uncertainty of trial.

Under the terms of the settlement, a fund of $200,000 will be created to cover claims from class members for economic losses and lost time related to the data breach. Each class member may claim up to $150 for ordinary economic losses and lost time and claims up to a maximum of $1,500 are permitted for extraordinary losses. The settlement also includes 36 months of credit monitoring services or a $25 payment in lieu of the credit monitoring services and reimbursement of economic losses. Claims will be paid pro rata if the claims total exceeds $200,000.

Class members have until December 14, 2022, to exclude themselves from or object to the settlement. Claims must be submitted by January 13, 2023. The fairness hearing is scheduled for January 10, 2023.

The post Sturdy Memorial Hospital & North Shore Pain Management Settle Data Breach Lawsuits appeared first on HIPAA Journal.

Receivables Performance Management Data Breach Affects More Than 3.7 Million Individuals

Posted by HIPAA Journal

Data breaches have recently been reported by Acuity Brands in Georgia, San Gorgonio Memorial Hospital in California, and Receivables Performance Management in Washington. The latter appears to have affected more than 3.7 million individuals.

Receivables Performance Management

Receivables Performance Management (RPM) in Lynnwood, WA, a business associate of several HIPAA-covered entities, has recently started notifying individuals affected by a 2021 ransomware attack. The incident was detected on May 12, 2021, with the investigation confirming its systems were first breached on April 8, 2021. Files only started to be encrypted on May 12.

RPM said it was able to stop the attack and restore its systems within 36 hours and retained a computer forensics firm to investigate the breach and determine the nature and scope of the attack; however, it took until October 2, 2022, to determine the types of information and individuals affected. RPM said that the length of time it took to fully investigate the breach was due to the complexities of RPM’s server infrastructure. RPM said it “obtained confirmation to the best of its ability that the information is no longer in the possession of the third party(ies) associated with this incident.”

RPM said personal information was potentially compromised, including Social Security numbers. Affected individuals are being offered complimentary credit monitoring services. RPM said it is continuing to work with security experts to improve its defenses to prevent similar breaches in the future. At this stage, the number of people affected by the breach has yet to be confirmed. The breach report submitted to the Maine Attorney general indicates 3,766,573 individuals have been affected in total, with approximately 500,000 of those individuals residing in Texas. The incident is not yet appearing on the HHS’ Office for Civil Rights breach portal.

Acuity Brands

Acuity Brands, a lighting and building management firm in Georgia, has announced that unauthorized individuals had access to its network on December 7 and December 8, 2021, and exfiltrated some files. While investigating that breach, Acuity Brands discovered an earlier security breach that occurred on October 6 and October 7, 2020, and in that earlier incident, unauthorized individuals had attempted to copy files from its systems.

A review of all documents potentially accessed in both incidents was then conducted, which revealed the files contained the information of current and former employees and members of its health plan. The incident was limited to employees. No customer information was compromised.

Both incidents resulted in the exposure and possible theft of files containing names, Social Security numbers, driver’s license numbers, financial account information, and limited health information related to other aspects of an individual’s employment with Acuity, such as injury information related to workers compensation claims, or related to requests for leave under the Family and Medical Leave Act. The types of information involved varied from individual to individual. Complimentary memberships to credit monitoring services are being offered to eligible individuals. Additional safeguards have been implemented to prevent further data breaches.

The incidents have yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

San Gorgonio Memorial Hospital

San Gorgonio Memorial Hospital in Banning, CA, has started notifying certain patients about a computer intrusion and data theft incident. A security incident was detected on November 10, 2022, and prompt action was taken to isolate and shut down its systems. The forensic investigation confirmed that an unauthorized individual gained access to its network on October 29, 2022, with access confirmed as terminating on November 10. During that period of access, files were copied from its systems, and on November 14, 2022, it was confirmed that those files contained patient information.

A prompt notification was sent to the California Attorney General, although the document review and investigation are ongoing. It has been confirmed that the documents contained information such as names, addresses, birth dates, medical record numbers, visit ID numbers, health insurance information, and/or clinical information, including diagnosis and treatment information.

San Gorgonio Memorial Hospital said additional safeguards have been implemented to prevent further data breaches.  The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Receivables Performance Management Data Breach Affects More Than 3.7 Million Individuals appeared first on HIPAA Journal.

More than 623,000 Patients Affected by CommonSpirit Health Ransomware Attack

Posted by HIPAA Journal

CommonSpirit Health has confirmed that the protected health information of at least 623,774 patients was exposed and potentially stolen in its October 2022 ransomware attack. CommonSpirit Health first announced it was dealing with a cyberattack on October 4, 2022, and has been providing regular updates on its website as more information about the attack has been uncovered. The attack was detected on October 2, 2022, with the investigation confirming the attackers had access to parts of its network between September 16 and October 3.

The last update, issued on December 1, 2022, confirmed that the individuals behind the attack accessed the data of patients who had received services in the past, or affiliates of those individuals, from Franciscan Medical Group and/or Franciscan Health (Now Virginia Mason Franciscan Health) in Washington state, including patients of St. Michael Medical Center (formerly Harrison Hospital), St. Anne Hospital (formerly Highline Hospital), St. Anthony Hospital, St. Clare Hospital, St. Elizabeth Hospital, St. Francis Hospital, and St. Joseph Hospital.

The breached data included names, addresses, phone numbers, dates of birth, and internal patient IDs. CommonSpirit Health said the breach did not affect Dignity Health, Virginia Mason Medical Center, TriHealth, or Centura Health facilities.

Suncoast Skin Solutions Reports 75,992-Record Data Breach

Suncoast Skin Solutions, a Lutz, FL-based network of medical and cosmetic dermatology practices, has recently started notifying patients that were affected by a cyberattack that was detected on or around July 14, 2021. Prompt action was taken to contain the incident, and third-party forensics experts were engaged to investigate and determine the nature and scope of the security breach.

The forensic investigation concluded on October 21, 2021, and revealed files on the network that contained patient data had been accessed in the attack, but its electronic medical record system was unaffected. A preliminary review was conducted to determine the types of information affected, which was completed on November 8, 2021. That review confirmed only legacy patient data was involved.

Suncoast started sending notification letters to affected individuals on November 28, 2022. In the breach notification letter sent to the Maine Attorney General, Suncoast said the lengthy delay in issuing notification letters was due to the nature and size of the affected data. The data mining process commenced in December 2021, and took until October 2022 to be completed. Suncoast explained that in the interim, in order to comply with the HIPAA Breach Notification Rule, a media notice was issued on January 7, 2022, and a notice was put on its website about the data breach.

Names, dates of birth, clinical information, doctor’s notes, and other limited treatment information were exposed and potentially compromised. Credit monitoring services have been offered to affected individuals. The breach report submitted to the HHS’ Office for Civil Rights in July indicates 57,730 individuals were affected. The more recent notification to the Maine Attorney General indicates 75,992 were affected.

The post More than 623,000 Patients Affected by CommonSpirit Health Ransomware Attack appeared first on HIPAA Journal.

New York Ambulance Service Facing Multiple Class Action Lawsuits over Ransomware Attack

Posted by HIPAA Journal

The New York ambulance service, Empress EMS, is facing multiple class action lawsuits over a ransomware attack that was detected on July 14, 2022. The Hive ransomware group was behind the attack, and as per the group’s modus operandi, after gaining access to the network, sensitive files were stolen, then files were encrypted.

According to the breach notifications sent by Empress EMS, the unnamed ransomware actors stole files that included names, dates of birth, demographic information, diagnosis and treatment information, medical record numbers, dates of service, insurance information, prescription information, and, for a small subset of individuals, Social Security numbers. Those files were stolen on July 13, 2022. The Hive ransomware group published some of the stolen data on their data leak site, but the data was promptly removed. According to databreaches.net, which contacted the Hive group, Empress EMS paid the ransom.

The breach investigation revealed the ransomware gang first gained access to the network on or around May 26, 2022. Notification letters were sent to affected individuals on September 9, 2022. The breach was reported to the HHS’ Office for Civil Rights as affecting up to 318,558 individuals. Individuals whose Social Security numbers were exposed or stolen were offered complimentary credit monitoring services.

The latest lawsuit, filed in Manhattan Federal court on behalf of plaintiff Robert D’Agostini and similarly situated individuals, alleges negligence for failing to adequately protect patient data, breach of implied contract, and violations of New York General Business law. The lawsuit also alleges Empress EMS violated HIPAA.

The lawsuit takes issue with the length of time it took Empress EMS to identify the intrusion – almost 2 months – and the length of time it took to notify affected individuals – more than 7 weeks. The lawsuit alleges Empress EMS unreasonably delayed issuing notifications. It should be pointed out that HIPAA allows regulated entities a maximum of 60 days to issue notifications from the date of discovery of a data breach, but states that notifications should be sent without unreasonable delay.

The lawsuit also claims that key information was omitted from the breach notification letters, specifically that the Hive ransomware gang was behind the attack – a group known to steal and publicly leak stolen data. The Hive group claimed to have stolen more than 100,000 Social Security numbers, which the lawsuit points out is not “a small subset of files.”

The lawsuit claims the plaintiffs and class members have had their privacy violated, their protected health information is in the hands of hackers, their PHI has been publicly leaked, and they face an imminent and ongoing risk of fraud and identity theft. The lawsuit seeks class action status, a jury trial, actual damages (or $50 per class member, whichever is higher), treble damages, and punitive damages. The lawsuit is one of at least 4 complaints that have been filed against Empress EMS over the data breach.

The post New York Ambulance Service Facing Multiple Class Action Lawsuits over Ransomware Attack appeared first on HIPAA Journal.