Alameda Health System in California, Capsule pharmacy in New York, and Aon PLC in Illinois have recently reported data breaches affecting a total of 56,290 individuals.

Alameda Health System Notifying 90,000 Patients About PHI Breach

Oakland, CA-based Alameda Health System has recently reported a data breach to the Department of Health and Human Services’ Office for Civil Rights that has affected up to 90,000 patients. Limited information has been released so far on the nature of the breach. Alameda Health System said suspicious activity was detected in the email accounts of certain employees with the investigation confirming several employee email accounts had been accessed by an unauthorized third party.

The review of those accounts confirmed they contained the protected health information of patients, although it is currently unclear to what extent patient information has been compromised. Alameda Health System said no evidence has been found that suggests any information in the accounts has been viewed or removed. Notification letters will be sent to affected individuals shortly, and measures will be implemented to improve security and mitigate harm to patients.

Capsule Pharmacy Breach Affects 27,486 Individuals

Capsule, a NY-based digital pharmacy, has started notifying 27,486 individuals that some of their protected health information has been exposed in a recent cyberattack. According to the breach notification sent to the California Attorney General, unauthorized individuals gained access to certain Capsule accounts on April 5, 2022.

The security breach was detected the same day and a password reset was performed on all affected accounts. A third-party digital forensics firm was engaged to assist with the investigation, which confirmed that the following types of information had potentially been compromised: demographic information such as names, email addresses, phone numbers, addresses, birthdates, and sex, health information including medical conditions and prescribed medications, past order histories, insurance information, chat messages to and from Capsule agents, and the last 4 digits of credit card numbers and expiry dates.

Capsule said additional security safeguards are being implemented. While a password reset has been performed on all affected accounts, Capsule has recommended users “set different passwords for your different accounts, use complex passwords or passphrases that are not easy to guess, and not reuse previous passwords,” which suggests the security breach may have been a password spraying attack.

PHI of More Than 28,700 Individuals Potentially Compromised in Aon PLC Cyberattack

Aon PLC, a Chicago, IL-based business associate that provides financial risk-mitigation products, including insurance and health insurance plans, has recently announced that it was the victim of a cyberattack. The security breach was discovered on February 25, 2022, with the forensic investigation confirming an unauthorized third party had gained access to certain Aon systems at various times between December 29, 2020, and February 26, 2022, and that certain documents containing individuals’ protected health information had been removed from its systems.

Aon said it has taken steps to confirm that the removed information is no longer in the possession of the third party there are no indications that the removed information has been further copied, retained, or shared, and there is no reason to suspect that any information has or will be misused. The affected information was limited to names, Social Security numbers, driver’s license numbers, and, for a limited number of individuals, benefit enrolment information. Aon said the incident was reported to the Federal Bureau of Investigation and other law enforcement authorities, and steps have been taken to further enhance security.

The post Data Breaches Reported by Alameda Health System, Aon, and Capsule Pharmacy appeared first on HIPAA Journal.

Allwell Behavioral Health Services in Zanesville, OH, has announced that a computer system used to store quality assurance information related to the treatment of patients has been accessed by an unauthorized individual. The unauthorized access was detected on March 5, 2022, with the subsequent forensic investigation determining the system was breached on March 2, 2022.

The breach investigation concluded in late April and determined that it was likely that files containing sensitive information had been copied in the attack, although at the time of issuing notifications to affected individuals there had been no reports of any actual or attempted misuse of patient data.

The types of information in the files varied from patient to patient and may have included information such as names, dates of birth, Social Security numbers, phone numbers, treatment activity, treatment provider, treatment date, treatment location, and payer information.

According to the breach summary on the HHS’ Office for Civil Rights website, 29,972 patients have been affected. Complimentary identity theft protection services have been offered to eligible participants for 12 months, and for 24 months for affected patients in CT, DC, RI, or MA. Allwell Behavioral Health Services said its information technology and computer systems have been upgraded to improve security and prevent further unauthorized access.

Email Account Breach Reported by WellDyneRx

The pharmacy benefit manager, WellDyneRx, has recently started notifying 5,122 individuals that an unauthorized individual has gained access to a company email account that contained sensitive patient information. Suspicious activity was detected in the email account on December 2, 2021, and immediate action was taken to secure the account. The third-party forensic investigation confirmed the account had been accessed by an unauthorized individual between October 30, 2021, and November 11, 2021.

Evidence of data theft was not found, but the possibility of unauthorized access to ePHI could not be ruled out. The review of the email account confirmed the following types of information had potentially been compromised: names, birthdates, Social Security numbers, driver’s license numbers, treatment information, health insurance information, contact information, prescription information, and other medical/health information. Steps have been taken to improve security to prevent similar attacks in the future.

The post PHI Potentially Compromised in Security Incidents at Allwell Behavioral Health Services and WellDyneRx appeared first on HIPAA Journal.

BJC HealthCare, a non-profit healthcare organization based in St. Louis, MO, has started notifying certain patients that some of their protected health information was stored in email accounts that were accessed by an unauthorized individual.

The investigation confirmed that a small number of email accounts of physicians and general practitioners had been accessed between March 4 and March 28, 2022. The forensic investigation did not determine whether emails and attachments had been viewed or copied, but unauthorized data access and theft could not be ruled out.

A comprehensive review of the email accounts confirmed they contained names, dates of birth, medical record numbers, and clinical information such as performance dates, diagnoses, provider names, and/or treatment locations. A limited number of patients also had their health insurance information, driver’s license numbers, and/or Social Security numbers exposed.

Individuals who had either their driver’s license number or Social Security number exposed can take advantage of the complimentary credit monitoring and identity theft protection services that have been offered.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

Email Incident Reported by Cooper University Health Care

Camden, NJ-based Cooper University Health Care announced on May 25, 2022, that the email account of an employee was accessed by an unauthorized individual on November 24, 2021. The security incident was detected on December 13, 2021, and the investigation concluded on May 10, 2022.

The email account contained information such as names, dates of birth, medical professional names, diagnosis and treatment information, billing and claims information, and medical record numbers. No evidence of actual or attempted misuse of patient data has been identified at the time of issuing notification letters.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Email Accounts Compromised at BJC HealthCare & Cooper University Health Care appeared first on HIPAA Journal.

Oswego County Opportunities (OCO) in New York has announced that a limited number of employee email accounts were recently accessed by an unknown actor. The security breach was identified when suspicious email activity was detected and the email accounts were immediately secured. Third-party cybersecurity experts were engaged to investigate the breach to determine the nature and scope of the attack, and what information, if any, had been accessed by the threat actor.

It was not possible to determine if any emails in the account had been viewed or obtained but the review of the affected email accounts confirmed they contained the following types of information: names, addresses, Social Security numbers, driver’s license numbers, certain health information, and a very limited amount of credit card numbers. The accounts also contained some employee information and information about vendors with connections to OCO.

The data breach has been reported to the HHS’ Office for Civil Rights as affecting 7,766 individuals. OCO said it has modified its email settings and controls to provide greater protection against cyberattacks of this nature.

Data Security Incident Reported by Washington University School of Medicine

Washington University School of Medicine in St Louis, MO, has recently announced that patient information has been exposed as a result of a recent data security incident. An unknown actor gained access to the email accounts of certain employees between March 4, 2022, and March 28, 2022.

A forensic investigation was conducted to determine if any emails or attachments were opened or obtained in the attack, although it was not possible to determine if patient data had been accessed or stolen. A review of all affected emails and attachments was conducted and confirmed they contained patient information such as names, dates of birth, addresses, medical records, patient account numbers, clinical information, and, for a limited number of patients, health insurance information and/or Social Security numbers.

In response to the breach, enhancements have been made to email security and employee training has been reinforced on how to identify and avoid suspicious emails. At present the data breach has not appeared on the HHS’ Office for Civil Right website so it is unclear how many patients have been affected; however, the School of Medicine said the breach did not affect all patients and research participants.

The post Email Incidents Reported by Washington University School of Medicine & Oswego County Opportunities appeared first on HIPAA Journal.