Des Plaines, IL-based Lutheran Social Services of Illinois, one of the largest providers of social services in the state, has announced that its systems were compromised and ransomware was used to encrypt files. The cyberattack was detected on January 27, 2022, and systems were taken offline to contain the attack. and third-party cybersecurity professionals were engaged to investigate the breach and determine the scope of the attack.

The forensic investigation and document review concluded on December 28, 2022, and confirmed that the attackers had access to its network between December 31, 2021, and January 27, 2022, and may have viewed or obtained files that contained protected health information. Data theft could not be ruled out, but at the time of issuing notifications, no reports had been received to suggest that sensitive information has been used for identity theft or fraud. The data potentially accessed included names, birth dates, Social Security numbers, financial information, driver’s license numbers, biometric information, diagnosis and treatment information, and health insurance information.

The HHS’ Office for Civil Rights data breach portal shows a breach reported by Lutheran Social Services of Illinois on March 25, 2022, indicating 1,000 individuals were affected. This coincides with the 60-day reporting deadline of the HIPAA Breach Notification Rule. This appears to have been a placeholder until the total number of individuals was determined. The breach notification sent to the Maine Attorney General indicates up to 184,183 individuals were affected, including 9 Maine residents. No reason was provided as to why it took 12 months from the date of discovery of the breach to issue breach notification letters to affected individuals.

Affected individuals have been offered complimentary Single Bureau credit monitoring services and Lutheran Social Services of Illinois said it has taken steps to further protect unauthorized access to individual records.

University of Colorado Hospital Authority Announced Third-Party Data Breach

University of Colorado Hospital Authority (UCHealth) has recently announced that one of its vendors has suffered a data breach that has affected 48,879 patients. UCHealth works with a software vendor called Diligent, which provides business operation tools and hosted services. Diligent recently notified UCHealth that it experienced a software incident that involved patient, provider, and employee data. The company’s software was accessed in the attack and attachments were downloaded from the hosted service that included UCHelath files. UCHealth’s email, electronic health records, and internal files were not impacted.

UCHealth said the stolen files included names, addresses, dates of birth, treatment-related information, and for a very limited number of individuals, Social Security numbers and/or financial information. UCHealth has confirmed that Diligent has implemented additional safeguards to prevent further data breaches.

PHI of PharmaCare Services and NextGen Healthcare Patients Posted on Dark Web

Cybercriminals have been attempting to extort money from the EHR and practice management solution provider, NextGen Healthcare, and Blanco, TX-based PharmaCare Services. Both healthcare organizations were recently added to the data leak site of the BlackCat ransomware group. The listing for NextGen Healthcare has since been removed but the PharmaCare Services listing is still live.

At the time of publication, no breach has been reported to the HHS’ Office for Civil Rights by either company. NextGen Healthcare has confirmed that an investigation has been launched into a security incident and that normal operations have resumed. A spokesperson for the company said client data does not appear to have been compromised and no evidence of data theft has been detected.

The BlackCat ransomware group operates under the ransomware-as-a-service model, with affiliates used to conduct attacks on behalf of the group for a percentage of any ransoms they generate. BlackCat claims that its affiliates are not permitted to attack medical institutions, hospitals, and ambulance services, although pharmaceutical firms and private clinics are not off-limits. The HHS has previously issued a warning about BlackCat ransomware, stating that while there appears to be a ban on attacks on the sector, ransomware gangs have previously violated their own bans on attacking healthcare organziations.

The post Up to 184,000 Clients of Lutheran Social Services of Illinois Impacted by Ransomware Attack appeared first on HIPAA Journal.

A round-up of data breaches that have recently been reported to the HHS’ Office for Civil Rights and state Attorneys General.

BayCare Clinic Announced Pixel-Related Data Breach

The Wisconsin-based healthcare provider, BayCare Clinic, LLP, has recently announced that the protected health information of up to 134,000 of its patients has been impermissibly disclosed to unauthorized third parties as a result of the use of pixels by its partner, Advocate Aurora Health. Advocate Aurora Health previously disclosed a pixel-related data breach that resulted in the personal and protected health information of up to 3 million of its patients being disclosed to third parties such as Google and Meta. The impermissible disclosures occurred when users visited its website and patient portal while logged into either their Google or Facebook accounts.

The types of information involved depended on users’ interactions on the MyChart and LiveWell websites and applications, which may have included the following types of data: IP address, dates, times, and/or locations of scheduled appointments, proximity to a practice location, provider information, type of appointment or procedure, whether the individual had insurance cover, communications between the patient and others through MyChart, which may have included first and last names and medical record numbers, and whether the user had a proxy MyChart account, in which case the first and last name of the proxy may have been disclosed.

Advocate Aurora Health has removed the pixels and will subject all tracking technologies to more stringent checks in the future.  Further information on the nature of the breach can be found in this post.

Rhode Island Department of Health Reports Internal Data Breach

The Rhode Island Department of Health (RIDOH) has announced there has been an internal impermissible disclosure of patient information. The breach was discovered on October 21, 2022, with the investigation confirming patient information was impermissibly disclosed between July and October 2022. A hyperlink to a spreadsheet was included in emails sent to employees and the spreadsheet contained information about the individuals who were receiving food deliveries while in isolation or quarantine during the COVID-19 pandemic. The spreadsheet contained information such as names, addresses, phone numbers, household information, delivery information, and information about the specific food needs of those individuals.

Access to the file was immediately restricted when the issue was detected, and a scan was conducted on email accounts to determine whether the emails had been shared. RIDOH said it is not aware of any misuse of the exposed information. Steps have since been taken to prevent further disclosures of this nature, including providing additional training to employees on the handling of sensitive information. Approximately 8,800 individuals were affected.

DCH Health System Discovers Insider Data Breach

Tuscaloosa, AL-based DCH Health System, has recently announced that a former employee has accessed the medical records of patients without authorization. The unauthorized medical record access was discovered by DCH Health on December 9, 2022, during a routine privacy audit. The audit revealed the employee had viewed the medical records of a patient on December 5, 2022, when there was no legitimate work reason for doing so. During the subsequent investigation, DCH Health discovered this was not the first time that medical records had been accessed by the employee, as the privacy violations had been occurring since September 2021. During that time, the records of approximately 2,530 patients were impermissibly accessed. The types of information viewed included names, addresses, birth dates, Social Security numbers, dates of encounters, diagnoses, vital signs, medications, test results, and clinical/provider notes.

DCH Health said the employee was immediately suspended when the first unauthorized access was discovered and was subsequently terminated over the privacy violations. Complimentary identity theft protection services have been offered to affected patients, although DCH Health said there are no indications that any patient information has been or will be misused. DCH Health said employees will continue to be provided with HIPAA and privacy training on appropriate access, and the incident will be used to improve privacy monitoring tools and processes.

Patient Data Compromised in Rundle Eye Care Hacking Incident

Drs. Keith and Herman Rundle have recently confirmed that the protected health information of certain Rundle Eye Care patients has been accessed and potentially obtained by unauthorized individuals. According to the breach notification letters, the attack occurred “recently” and involved patient names, birth dates, and treatment information.

While data theft may have occurred, there are no indications that patient data have been or will be misused. As a precaution against the misuse of patient data, affected patients have been offered complimentary single bureau credit monitoring services for 12 months. Measures have also been taken to strengthen system security.

While ransomware was not mentioned in the breach notice, the Everest Ransomware Group claimed responsibility for the attack and says 30 GB of data was stolen, including tax records, medical records, and prescription forms.

Satellite Healthcare Reports Breach Affecting 95,000 Patients

San Jose, CA-based Satellite Healthcare has recently reported a breach of the PHI of 95,128 patients to the Texas Attorney General, including 22 Texas residents. Few details are available on the breach at this stage as the incident has yet to appear on the website of the California attorney general and there is no notice on the healthcare provider’s website.

What is known is the breach involved protected health information such as names, medical information, health insurance information, and financial information. Notifications have been issued to affected individuals by mail. Satellite Healthcare was contacted for further information on the breach, but no immediate response was received. This post will be updated when further information becomes available.

The post PHI of More Than 240K Patients Compromised in 5 Healthcare Data Breaches appeared first on HIPAA Journal.

A Washington therapist, Robert S. Miller LICSW, ACSW (RSM), has recently notified 640 current and former clients about a phishing incident that resulted in the exposure of some of their protected health information.

State laws require notifications to be sent to state attorneys general when there has been a breach of the private information of state residents. The notifications typically provide the minimum information about privacy breaches, but in this case, the therapist explained exactly how the phishing attack played out.

RSM had purchased an antivirus solution from the Iolo Software Company, and subsequently purchased an additional encryption program, which had disappeared from his computer. RSM was contacted by a person who claimed to be an Iolo employee who said he was aware that RSM’s computer had been hacked and requested access to clean the computer of viruses and malware. Access to the device was granted. RSM said he discovered this was a scam when the employee requested eBay cards worth $300.

As a result of this incident, that individual had access to the computer from December 2 to December 4, 2022, and potentially obtained files containing names, dates of birth, mailing addresses, email addresses, phone numbers, medical insurance ID numbers, Social Security numbers, and clinical information, which included evaluations, progress notes, mental health rating scales, and letters.

In response to this incident, RSM has taken several steps to prevent similar incidents in the future, including adopting encryption technologies, strengthening passwords, and engaging a third-party software company to review computers and remove any malware that may have been installed. Affected clients have been offered complimentary identity theft protection services.

Email Account Breach Reported by MJ Care

MJ Care, a New Berlin, WI-based provider of rehabilitation and health services, has recently notified 1,832 patients that some of their protected health information has potentially been accessed or obtained by an unauthorized individual. MJ Care did not state when the breach was detected; however, the investigation revealed the email account was accessed between May 31, 2022, and June 24, 2022.

The review of the affected email account concluded on November 2, 2022, and confirmed it contained patient names along with one or more of the following types of information: Social Security numbers, dates of birth, financial account information, credit/debit card information, biometric information, dates of service, treatment/diagnosis information, provider name, medical record numbers, patient numbers, medications, general medical information, and/or health insurance policy information. Notifications were sent to affected individuals on December 29, 2022. Complimentary credit monitoring services have been offered to patients whose Social Security numbers were exposed.

The post Phishing Attack on Washington Therapist Exposes Patients’ PHI appeared first on HIPAA Journal.

The Massachusetts-based medical device company, Insulet Corporation, has recently notified 29,000 of its Omnipod DASH customers about a recent privacy breach. A Medical Device Correction letter was recently sent to customers. Due to the importance of applying the update, a follow-up receipt acknowledgment request was sent via email on December 1, 2022.

The emails included a clickable link that directed customers to a webpage that was used for receipt verification; however, an error was made configuring that website which resulted in an impermissible disclosure of customers’ protected health information. Each customer was sent a unique URL that included their IP address, whether the customer was an Omnipod DASH user, and if they had a Personal Diabetes Manager.

Cookies and trackers embedded in the MDC acknowledgment pages transferred details of the URLs to third-party website performance and marketing partners. Insulet said the privacy violation was discovered on December 6, 2022, and all tracking technologies on the web pages were disabled to prevent further PHI exposure, and requests were sent to Insulet’s marketing partners requesting they delete the logs of the IP addresses and unique URLs.

Minnesota Department of Human Services Employee Error Impacts 4,307 Individuals

A mistake by an employee of the Minnesota Department of Human Services (DHS) has resulted in the impermissible disclosure of the protected health information of 4,307 Minnesota residents. On November 18, 2022, in response to a request from a client for a copy of their own data, the employee accidentally sent the billing statements of 4,307 individuals who were enrolled in Medical Assistance.

The investigation found no evidence to suggest the information was downloaded or misused. The patient who was sent the data notified DHS about the error and said the email would be deleted. The DHS confirmed that highly sensitive information such as Social Security Numbers, banking information, and credit card numbers were not included in the statements. Notification letters were sent to all affected individuals on January 11, 2023.

The post Tracking Code Privacy Incident Affects 29,000 Insulet Corporation Customers appeared first on HIPAA Journal.

The Dallas, TX-based home help service provider, Home Care Providers of Texas (HCPT), has recently announced that unauthorized individuals gained access to its network and used ransomware to encrypt files. The security breach was detected on June 29, 2022, when staff members were prevented from accessing files. Leading third-party cybersecurity experts were engaged to investigate the incident and determine the nature and scope of the breach and confirmed that the threat actors had access to its network between June 15, 2022, and June 29, 2022. During that time, files were exfiltrated from the network that contained names, addresses, dates of birth, Social Security numbers, treatment or diagnosis information, and medication information.

The delay in issuing notification letters was due to the lengthy process of reviewing all files potentially accessed or obtained to determine which individuals had been affected. That process was completed on November 15, 2022. Affected individuals have been advised to monitor their credit reports, accounts, and explanation of benefits statements for unauthorized activity. HCPT said steps have since been taken to augment cybersecurity.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal but has been reported to the Texas Attorney General as affecting 124,363 Texas residents.

Circles of Care, Inc. Hacking Incident Affects 61,170 Individuals

Circles of Care, a Florida-based provider of behavioral care services, has recently announced that employee and patient information was potentially compromised in a September 2022 cyberattack. Suspicious activity was detected within its network on September 21, 2022, with the investigation confirming an unauthorized third party gained access to the network on September 6, 2022.

The forensic investigation confirmed on November 29, 2022, that the unauthorized third party had access to parts of the network that contained patient and employee information such as names, dates of birth, Social Security numbers, addresses, phone numbers, driver’s license numbers, bank routing and account numbers, medical account numbers, provider names, service dates, diagnoses, and medical procedure codes. That information was potentially accessed or acquired, although, at the time of issuing notifications, no reports of misuse of that information have been received. Affected individuals have been advised to be vigilant against incidents of identity theft and fraud by reviewing their account statements and explanation of benefit forms.

The breach has been reported to the HHS’ Office for Civil Rights as affecting up to 61,170 individuals.

Community Health Network Says Tracking Technologies Impermissibly Disclosed PHI of Fishers Digestive Care Patients

Indianapolis, IN-based Community Health Network has recently announced that tracking technologies were used on the website and patient portal of its affiliated organization, Fishers Digestive Care, which resulted in patient data being impermissibly disclosed to third parties. The disclosed information included names, medical record numbers, IP addresses, appointments, insurance coverage, healthcare provider information, and conversations between individuals and others through the MyChart patient portal. The extent to which each individual was affected could not be determined and would have depended on their interactions on the website and patient portal.

Community Health Network previously reported the breach to the Office for Civil Rights as affecting up to 1.5 million patients. It is currently unclear how many Fishers Digestive Care patients have been affected, and whether they are included in the 1.5 million total.

The post Home Care Providers of Texas Announces 124K-Record Data Breach appeared first on HIPAA Journal.