Salida, CO-based First Street Family Health has suffered a destructive cyberattack, in which files containing patient information were exfiltrated and then deleted from its systems. This method of attack is becoming more common, where data is stolen, deleted, and then threats are issued to publish or sell the data if payment is not made to the attackers, but files are not encrypted using ransomware.

First Street Family Health said the attack was detected on July 16, 2022, with the investigation confirming that the attackers first gained access to its systems on July 5, 2022. The unauthorized access was blocked on July 16. The attackers deleted electronic medical records from June 28, 2021, to July 15, 2022, and while backups of those records had been made, the backups were also deleted so the information in those records has been lost. No evidence was found to indicate those records were stolen. Medical referral forms stored on the affected computer systems may have been viewed or acquired, but those records were successfully restored from backups.

The breached records included full names, addresses, birth dates, phone numbers, email addresses, Social Security numbers, dates of service, nature of services, diagnoses, conditions, lab results, medications, health insurance identification cards and numbers, and billing information.

Notification letters were sent to affected individuals on August 26, 2022, and complimentary memberships to CyberScout’s credit monitoring service have been offered. First Street Family Health said a national cybersecurity firm assisted with the investigation and conducted a security review, and additional security measures are being implemented based on the firm’s recommendations.

The incident has not yet appeared on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

Northeast Rehabilitation Hospital Network Notifies Patients About 2021 Cyberattack

Salem, NH-based Northeast Rehabilitation Hospital Network (NRHN) has started notifying patients that unauthorized individuals gained access to its computer systems and may have viewed or obtained sensitive data. The data breach was detected on September 30, 2021, when suspicious activity was detected within its network. The subsequent investigation confirmed its systems were compromised between September 30, 2021, and October 5, 2021.

NRHN said the delay in issuing notifications to affected individuals was due to the time-consuming process of reviewing all affected files on its systems, and that process was not completed until August 3, 2022. Notification letters are now being sent and individuals will be informed in those letters about the types of information that were involved. NRHN said it is unaware of any attempted or actual misuse of patient data. Credit monitoring and Identity theft protection services have been offered to affected individuals.

This post will be updated when the number of affected individuals is known.

The post Cyberattack and Data Destruction Reported by First Street Family Health appeared first on HIPAA Journal.

EmergeOrtho, a North Carolina orthopedic practice, has recently notified 75,200 patients that some of their protected health information has been accessed by unauthorized individuals. According to EmergeOrtho’s substitute breach notice, a sophisticated ransomware attack was detected and blocked on May 18, 2022. The forensic investigation confirmed that the threat actors behind the attack had accessed files containing patients’ protected health information.

A comprehensive review of all affected files confirmed on August 19, 2022, that they contained information such as first and last names, addresses, Social Security numbers, and, for certain individuals, date of birth. No medical records, treatment information, or financial information was compromised in the attack and no evidence has been identified that suggests any of the affected information has been specifically misused.

EmergeOrtho said leading IT specialists were engaged to confirm the security of its network environment, steps will continue to be taken to enhance the security of its systems, and additional monitoring tools have been deployed to proactively identify any future attempted intrusions. EmergeOrtho has offered affected individuals a complimentary membership to single bureau credit monitoring services.

General Health System Notifies Patients About Ransomware Attack and Data Theft

Baton Rouge, LA-based General Health System, which operates Baton Rouge General Medical Center, has recently confirmed that unauthorized individuals gained access to its network and exfiltrated files containing patient data. The forensic investigation confirmed that the attackers had access to its network and files within certain directories between June 24, 2022, to June 29, 2022. The cyberattack was detected on June 28, 2022.

General Health System said the investigation into the attack is ongoing and a comprehensive review is being conducted of all files within the directories that could have been accessed. At this stage, the extent to which patient data has been compromised has yet to be confirmed and it is currently unclear how many individuals have been affected. Notification letters will be sent once that process has been completed.

The attack has caused some disruption to operations, and while care continues to be provided to patients, ambulances have been directed to alternative facilities. General Health System did not provide details on the nature of the attack; however, the Hive ransomware group has claimed responsibility and has started to add some of the stolen data to its leak site, which suggests the ransom was not paid.

The post EmergeOrtho & General Health System Victims of Ransomware Attacks appeared first on HIPAA Journal.

Methodist McKinny Hospital in Texas has recently announced that its systems have been accessed by unauthorized individuals who removed files containing sensitive data from its systems. The security incident was detected on July 5, 2022, and a third-party cybersecurity firm was engaged to investigate the nature and scope of the incident. The investigation confirmed that the attackers had access to its systems between May 20, 2022, and July 7, 2022, and during that time, files were exfiltrated that contained patient data. The preliminary investigation has confirmed that the files contained names, addresses, Social Security numbers, birth dates, medical history information, medical diagnosis information, treatment information, medical record numbers, and health insurance information.

The investigation into the security breach is ongoing and a detailed review of all affected files has been initiated to determine the patients affected. The breach is known to have affected patients of Methodist McKinney Hospital, Methodist Allen Surgical Center, and Methodist Craig Ranch Surgical Center. Notifications will be sent to affected individuals in due course. It is currently unclear how many individuals have been affected.

Methodist McKinny Hospital did not disclose the nature of the attack in the substitute breach notification, but this appears to have been a ransomware attack. The Karakurt ransomware gang has listed Methodist McKinny Hospital on its data leak site as a pre-release and claims to have exfiltrated 367 GB of data in the attack.

Columbia River Mental Health Services Reports Breach of Employee Email Accounts

Columbia River Mental Health Services has recently notified the HHS’ Office for Civil Rights about a security incident involving certain employee email accounts. According to the breach notice, suspicious activity was detected in certain email accounts, and third-party forensics experts were engaged to investigate the breach. The investigation confirmed that the email accounts were accessed by unauthorized individuals between May 14, 2021, and April 8, 2022.

A review was conducted of the affected accounts, which confirmed on July 6, 2022, that they contained patients’ protected health information. The review of the information in the accounts is ongoing and notification letters will be sent to affected individuals when the review is completed. The breach has been reported to the HHS’ Office for Civil Rights as affecting ‘501’ individuals to meet the deadline for reporting the incident. The breach total will be updated when the number of affected individuals is confirmed.

The post PHI Exposed in Cyberattacks on Methodist McKinny Hospital and Columbia River Mental Health Services appeared first on HIPAA Journal.

Onyx Technologies, a Largo, MD-based provider of Information Technology and Consulting Services and a vendor of Independent Care Health Plan (iCare), has recently notified 96,814 health plan members that some of their protected health information has potentially been compromised.

On June 28, 2022, Onyx discovered its computer systems had been accessed by unauthorized individuals, who may have gained access to the protected health information of iCare members, including names, birth dates, addresses, phone numbers, iCare member ID numbers, Medicare ID Numbers, dates of service, and provider names.

Onyx said that a review of its computer systems was immediately conducted, a security firm was engaged to assist with the investigation, and access to its systems was regained on July 7, 2022. Onyx said, “a server may have been removed or accessed beginning on March 29, 2022, and ending on June 28, 2022. On July 15, 2022, the security firm found that some information related to individuals may have been accessed.”

Onyx said it found no evidence to suggest any of the affected information has been identified. Affected individuals have been offered complimentary credit monitoring and identity theft protection services for two years.

San Diego American Indian Health Center Breach Affects 27,367 Patients

San Diego American Indian Health Center has notified 27,367 current and former patients that unauthorized individuals gained access to parts of its network and exfiltrated files containing some of their protected health information.

The security breach was detected on May 5, 2022, and steps were immediately taken to secure the network and prevent further unauthorized access. A digital forensics firm was engaged to assist with the investigation, which confirmed on July 22, 2022, that patient information had been obtained, including names, Social Security numbers, driver’s license numbers, state identification card numbers, tribal identification card numbers, medical information, health insurance information, and birth dates.

San Diego American Indian Health Center said it is unaware of any attempted or actual misuse of patient data. Affected individuals have been offered complimentary credit monitoring and identity protection services and steps have been taken to improve security to prevent further data breaches.

New Jersey Department of Health Alerts Patients About Vendor Data Breach

The New Jersey Department of Health, Division of Behavioral Health Services has recently announced that certain patients of Trenton Psychiatric Hospital and the Anne Klein Forensic Center have had some of their protected health information stolen in a security incident at a vendor that provided medical translation and dictation services to the hospitals.

Unauthorized individuals gained access to parts of the vendor’s systems and exfiltrated files that included the protected health information of patients.  The vendor notified the NJ Department of Health about the data breach on June 30, 2022. It is currently unclear which vendor was affected, the types of information compromised, and the number of individuals affected by the data breach. The affected hospitals will notify patients directly if they have been affected.

The post Data Breaches Reported by the New Jersey Department of Health, Onyx Technologies & San Diego American Indian Health Center appeared first on HIPAA Journal.

The California Department of Corrections and Rehabilitation (CDCR) has recently discovered that unauthorized individuals have gained access to one of its information systems. The compromised system contained medical information on all individuals who had been tested for COVID-19 between June 2020 and January 2022, including staff members, visitors, and other individuals, although not inmates. The information related to COVID-19 tests included name, personal address, telephone number, email, date of birth, and COVID-19 testing results.

Files on the system also included the mental health information of inmates in the Mental Health Services Delivery System dating back to 2008, as well as the information of individuals on parole who were in substance use disorder treatment programs. Some of the exposed data included Social Security Numbers, driver’s license numbers, and trust account information.

The data of inmates included name, CDCR number, mental health treatment, mental health history, and mental health diagnosis, and information in the Trust, Restitution, Accounting, and Canteen System (TRACS) was also potentially involved, which includes transaction records made by CDCR to and from trust accounts since 2008, along with some trust account numbers.

CDCR said the data breach was discovered during routine maintenance. The investigation did not confirm when the system was first compromised; however suspicious activity was identified in a file transfer system dating back to December 2021. CDCR was unable to confirm whether any specific information had been accessed or exfiltrated and said no corroborating evidence was found to suggest any exposed data has been compromised or misused.

CDCR said procedures and practices have been updated to limit the potential for further breaches and the affected computer system is no longer being used. A replacement computer system has been implemented with more security controls.

The incident has not yet appeared on the HHS’ Office for Civil Rights Breach Portal so it is currently unclear how many individuals have been affected.

Lamoille Health Partners Hit with Ransomware Attack

Lamoille Health Partners in Vermont has recently confirmed that it was the victim of a ransomware attack on June 13, 2022. Prompt action was taken to prevent further unauthorized access to its systems and a third-party digital forensics firm was engaged to assist with the investigation. Lamoille Health Partners said it was possible to securely restore the encrypted files from backups so no ransom was paid; however, the forensic investigation confirmed that the attackers had access to its systems between June 12, 2022 and June 13, 2022, and during that time it is possible that documents containing patients protected health information may have been accessed or acquired.

On June 24, 2022, Lamoille Health Partners determined that the documents that may have been accessed included patient information such as names, addresses, dates of birth, Social Security numbers, health insurance information, and medical treatment information. 59,381 individuals have been notified that their protected health information was exposed. Complimentary identity protection and credit monitoring services have been offered to individuals who had Social Security numbers exposed.

The post California Department of Corrections and Rehabilitation Hack Exposed Sensitive Data appeared first on HIPAA Journal.

Little Rock, AR-based Independent Case Management (ICM), a provider of home and community-based support for individuals with intellectual and developmental disabilities, has recently notified 3,307 individuals that some of their protected health information may have been stolen in a ransomware attack.

According to the notification letters, three servers were affected by the attack. The servers were encrypted on December 24, 2021, and a ransom note was dropped on the servers; however, the attack was not detected by ICM until June 15, 2022, as the servers were only used to store historical employee and customer data.

When the attack was detected, a third-party IT vendor was engaged to isolate the servers and perform security scans to ensure that access to the servers was blocked and no other systems or data were affected. The investigation confirmed that only 3 servers were affected, and they contained information such as names, addresses, dates of birth, Social Security numbers, health records, insurance plan and payment information, Medicaid numbers, and medical and health records. Some employee files were also stored on the servers. ICM said it was not possible to determine if specific personal information was accessed, removed, or misused.

ICM said steps have been taken to improve the privacy and security of personal information, including conducting regular security scans, implementing multifactor authentication, improving monitoring systems, and providing additional cybersecurity training to employees.

Conifer Health Solutions Discovers Email Account Breach

Conifer Health Solutions, a Frisco, TX-based provider of revenue cycle management and other administrative services to healthcare providers, has recently discovered that an unauthorized third-party gained access to a Microsoft Office 365 hosted business email account.

The breach was detected during an internal review, with the subsequent investigation determining the email account was compromised on January 20, 2022. The breach was confined to a single email account, which was separate from its internal network and systems. The review of the email account was conducted between June 13 and August 3 and determined it contained the protected health information of 2,787 individuals, including full names, dates of birth, addresses, Social Security numbers, financial account information, medical and treatment information, health insurance information, and billing and claims information.

Steps were immediately taken to prevent further unauthorized access and additional security measures have now been implemented, including multifactor authentication and enhanced monitoring of the email environment. Complimentary credit monitoring and identity protection services have been offered to individuals whose Social Security numbers or financial account information was exposed.

The post Cyberattacks Reported by Independent Case Management & Conifer Health Solutions appeared first on HIPAA Journal.

Practice Resources, a Syracuse, NY, provider of billing and other professional services, has suffered a data breach involving the records of 942,138 individuals.

According to the breach notification sent to the California Attorney General, Practice Resources was the victim of a ransomware attack on April 12, 2022. Assisted by third-party digital forensics experts, Practice Resources determined that there had been unauthorized access to parts of the network where the protected health information of its clients was stored and the attackers may have infiltrated that information prior to file encryption.

A review of the documents potentially affected by the attack confirmed they contained information such as names, addresses, dates of treatment, health plan numbers, and medical record numbers. Practice Resources has offered affected individuals a complimentary membership to an identity theft protection and credit monitoring service.

Practice Resources said it has issued notification letters to affected individuals on behalf of 28 clients that were affected by the data breach.

• Achieve Physical Therapy, PC
• CNY Obstetrics and Gynecology, P.C.
• Community Memorial Hospital, Inc
• Crouse Health Hospital, Inc
• Crouse Medical Practice PLLC
• Family Care Medical Group, PC
• Fitness Forum Physical Therapy, PC
• FLH Medical PC
• Greece Dermatological Associates, PC
• Guidone Physical Therapy, PC
• Hamilton Orthopedic Surgery & Sports Medicine
• Helendale Dermatological and Medical Spa, PLLC
• Kudos Medical, PLLC
• Laboratory Alliance of Central New York, LLC
• Liverpool Physical Therapy, PC
• Michael J Paciorek, MD PC
• Nephrology Associates of Watertown, PC
• Nephrology Hypertension Associates of CNY, PC
• Orthopedics East, PC
• Salvation Army
• Soldiers & Sailors Memorial Hospital—Physician Practices
• Joseph’s Medical
• Surgical Care West, PLLC
• Syracuse Endoscopy Associates, LLC
• Syracuse Gastroenterological Associates, PC
• Syracuse Pediatrics
• Tully Physical Therapy
• Upstate Community Medical, PC

Valley Baptist Medical Center Systems Hacked

Brownsville, TX-based Valley Baptist Medical Center has recently started notifying certain patients that some of their protected health information has been exposed and potentially stolen. On June 14, 2022, Valley Baptist determined that an unauthorized third party had gained access to a computer system. The forensic investigation determined that unauthorized access occurred between March 31 and April 24, 2022.

When the breach was detected, user access to systems was suspended, cybersecurity protocols were implemented, and steps were taken to prevent further unauthorized access. The forensic investigation determined that patient information was potentially affected, including names, contact information, dates of birth, health insurance information, dates of service, patient account numbers, medical record numbers, medications, diagnosis information, provider and facility names, and visit information. Valley Baptist said patients of its Brownsville and Harlingen medical centers were affected.

The data breach has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Ransomware Attack on New York Billing Company Affects 942K Individuals appeared first on HIPAA Journal.