The Oklahoma City home health provider, Healthback Holdings, has started notifying 21,114 individuals that some of their protected health information has potentially been viewed or obtained by unauthorized individuals. Unusual activity was detected within its email environment on June 1, 2022. A third-party cybersecurity firm was engaged to assist with the investigation and confirmed that a limited number of employee email accounts had been accessed by an unauthorized third party between October 5, 2021, and May 15, 2022, as a result of responses to phishing emails.

It was not possible to tell which emails, if any, had been viewed, nor if any information in the accounts had been stolen. Notification letters were therefore sent to all individuals whose protected health information was present in the affected email accounts. The exposed information varied from individual to individual and may have included names, health insurance information, Social Security numbers, and clinical information.

Complimentary credit monitoring and identity theft protection services are being provided to eligible individuals. Healthback Holdings has strengthened its email security and further training has been provided to employees on how to detect and avoid phishing emails.

Hacking Incident Reported by the City of Newport in Rhode Island

The City of Newport, RI, has recently reported a breach of the protected health information of 6,109 individuals to the HHS’ Office for Civil Rights. Unusual network activity was detected within its network on June 9, 2022, and certain systems on the network became unavailable. The forensic investigation confirmed hackers had gained access to its network on June 8, 2022, and removed files containing sensitive information from its systems.

A review of the affected files was completed on June 12, 2022, and confirmed that they contained the information of current and former employees and their spouses and/or dependents, including names, addresses, dates of birth, Social Security numbers, financial account numbers used for direct deposit, and information related to group health insurance.

Notification letters were sent to affected individuals on July 22, 2022. Complimentary memberships to identity monitoring services have been offered to affected individuals and steps have been taken to improve the security of the network.

Minuteman Senior Services Email Account Accessed by Unauthorized Individual

Bedford, MA-based Minuteman Senior Services has discovered that an unauthorized individual gained access to an employee’s email account and potentially viewed or obtained sensitive information in the account. The unauthorized access was detected on June 1, 2022, with the forensic investigation confirming the account had been accessed for less than 24 hours.

In a July 29, 2022, substitute breach notification, Minuteman explained that the account contained information such as full names, addresses, birth dates, gender, health insurance information, diagnosis, and service utilization information. No evidence of data theft or misuse has been identified at the time of issuing notifications.

The breach has been reported to the HHS’ Office for Civil Rights as affecting up to 4,000 individuals.

OrthoArizona Notifies Patients About October 2021 Cyberattack

OrthoArizona has recently started notifying 2,748 individuals that their protected health information was exposed and potentially stolen in a cyberattack that was detected on October 30, 2021. OrthoArizona said it quickly engaged the services of a third-party cybersecurity company to assist with the investigation but said the investigation and remediation process was “extensive and labor intensive,” which is why it has taken so long to issue notifications.

The review of the affected files confirmed they contained names, mailing addresses, dates of birth, Social Security numbers, and certain health insurance information. No cases of fraud have been identified as a result of the incident. Individuals who had their Social Security number exposed have been offered complimentary credit monitoring and identity theft protection services through IDX. OrthoArizona said it has reviewed and enhanced its data security policies and procedures.

The post Healthback Holdings Email Security Breach Affects 21,000 Individuals appeared first on HIPAA Journal.

Fast Track Urgent Care, a network of urgent healthcare clinics in Florida, has confirmed that 258,411 individuals have had their protected health information exposed and potentially stolen in a ransomware attack on billing and practice management vendor, PracticeMax.

PracticeMax said it identified suspicious activity within its network on May 1, 2021, and confirmed that ransomware was installed on its network. The billing vendor was able to recover the data on its system on May 6, 2021, with the investigation into the breach confirming that its systems had been compromised between April 17 and May 5, 2021. A server used by PracticeMax and several email accounts were affected and data on its systems was encrypted.

The breach affected several of its healthcare clients, including Anthem Inc and Humana. The two health insurance firms confirmed they had been affected in late February 2022, with PracticeMax publicly reporting the breach in the fall of 2021. Fast Track Urgent Care said it was first notified about the ransomware attack by PracticeMax on May 10, 2021, but at that stage of the investigation, it was unclear whether the protected health information of its patients had been viewed or stolen in the attack.

On February 14, 2022, Fast Track Urgent Care said it was ‘first informed’ by PracticeMax that patient data may have been impacted, but PracticeMax could still not confirm whether customer and patient data had been accessed or stolen and that the investigation was ongoing. Fast Track Urgent Care said it took until June 6, 2022, 13 months after the initial breach, for PracticeMax to confirm that Fast Track Urgent Care patient data had been accessed.

Fast Track Urgent Care said the types of information compromised in the incident included names, Social Security numbers, passport numbers, treatment and diagnosis information, driver’s license numbers, birth dates, health insurance information, and financial information, and has confirmed that PracticeMax has offered affected individuals’ complimentary memberships to credit monitoring and identity theft protection services. Notification letters are being sent to affected individuals by PracticeMax on behalf of Fast Track Urgent Care.

Fast Track Urgent Care said PracticeMax took several steps to resolve the security incident and has reviewed policies and procedures and implemented additional safeguards to better secure the information on its systems.

The post Fast Track Urgent Care Confirms 258,411 Individuals Affected by 2021 PracticeMax Ransomware Attack appeared first on HIPAA Journal.

The health insurer Aetna ACE is one of the latest healthcare organizations to announce it has been affected by a ransomware attack on a mailing vendor, which involved the protected health information of 326,278 plan members. Aetna said the breach was limited to individuals insured under Aetna ACE, and that no protected health information of individuals served by Aetna or CVS Health was involved.

The ransomware attack affected OneTouchPoint, which provides printing and mailing services for U.S. companies, including billing vendors used by healthcare organizations. OneTouchPoint is provided with contact information and limited other data types to provide its contracted services. On April 28, 2022, OneTouchPoint discovered files had been encrypted on its systems, with the unauthorized access occurring the previous day on April 27, 2022.

Third-party cybersecurity specialists were engaged to investigate the security incident and completed the investigation on June 1, 2022, but were unable to determine which specific files were exfiltrated from its systems. Affected customers were notified on June 3, 2022, and OneTouchPoint worked with those customers to determine the type of information that could potentially have been viewed or removed from its systems. The exposed and potentially stolen data included names, addresses, dates of birth, member IDs, and limited medical information.

OneTouchPoint said it offered to send notifications to all affected individuals; however, some of its clients have chosen to self-report the breach and send notifications themselves. OneTouchPoint has reported the incident on behalf of 30 health plans and informed the Maine Attorney general that 1,073,316 individuals had been affected. Aetna ACE chose to self-report the breach. Other health plans affected by the OneTouchPoint ransomware attack include Anthem, Humana, Kaiser Permanente, Geisinger, Health First, UPMC Health Plan, Blue Shield of California Promise Health, Blue Cross and Blue Shield of Alabama, and other Blue Cross Blue Shield-affiliated health plans.

Aetna ACE is no stranger to data breaches at business associates. In 2020, a phishing attack on a business associate exposed the PHI of 484,157 Aetna ACE plan members. An employee of vendor EyeMed responded to a phishing email, which give unauthorized individuals access to email accounts that contained the PHI of 2.1 million individuals. EyeMed was fined $600,000 by the New York State Attorney General for security failures that led to the data breach.

Aetna also experienced another mailing-related data breach in 2017 that affected 12,000 individuals. In that case, a mailing was sent to members to inform them about different options for filling prescriptions for their HIV medications; however, window envelopes were used through which the HIV drug information was clearly visible, making it clear that the members were being treated for HIV or were taking HIV medications to prevent infection. Aetna was investigated by state attorneys general and settled the cases and paid more than $2,725,000 million in penalties. A $1,000,000 penalty was also imposed by the HHS’ Office for Civil Rights, and Aetna settled a class action lawsuit for $17 million.

The post 326,278 Aetna ACE Members Affected by Ransomware Attack at Mailing Vendor appeared first on HIPAA Journal.

St. Luke’s Health System in Boise, ID, has recently reported a data breach to the HHS’ Office for Civil Rights that has affected 31,579 patients. The breach occurred in May 2022 at Kaye-Smith, the health system’s billing vendor, and affected patients that were billed that month. The breach was discovered in June 2022 and was reported to St. Luke’s Health System on July 6, 2022.

Unauthorized individuals gained access to systems at Kaye-Smith, which contained information such as patient names, insured names, addresses, phone numbers, ID numbers, dates of birth, descriptions of services, amounts billed, outstanding balances, payment due dates, account statuses, and the last five digits of Social Security numbers. Kaye-Smith is investigating the breach and is working with the FBI to better understand how the breach happened.

St. Luke’s Health System said it is no longer working with the billing vendor. The investigation to date has not uncovered any evidence to suggest there has been any misuse of patient data. Affected individuals have been offered a complimentary membership to a credit monitoring service.

Goldsboro Podiatry Notifies 30,669 Patients About Data Breach

Kevin Wolf, DPM, doing business as Goldsboro Podiatry in North Carolina, has recently confirmed that the protected health information of 30,669 has potentially been obtained by unauthorized individuals. The breach occurred at an unnamed service provider that maintains patients’ electronic medical records for the practice. The breach was detected on April 29, 2022, when certain servers used by the company were encrypted in a ransomware attack. The service provider confirmed in May 2022 that data on the servers had been accessed and was potentially obtained by the attackers. Goldsboro Podiatry was notified about the attack on May 20, 2022.

The information compromised in the attack included names, contact information, dates of birth, Social Security Numbers, demographic information, medical history, medication information, clinical observations, diagnoses, and/or treatment plans.

Goldsboro Podiatry said its service provider has secured its information technology systems and enhanced its cybersecurity defenses to prevent future attacks and has offered affected individuals complementary access to credit monitoring and identity theft protection services.

Allegheny Health Network Phishing Attack Affects Thousands of Patients

Pennsylvania-based Allegheny Health Network has recently confirmed that the email account of an employee has been accessed by an unauthorized third party following a response to a phishing email. The employee responded to the message on May 31, 2022, and the breach was detected the following day.

A review of the email account confirmed it contained protected health information such as names, dates of birth, dates of medical services, medical histories, conditions, diagnoses and treatment information, and driver’s license numbers. A subset of individuals also had their Social Security number and/or financial information exposed.

Allegheny Health Network said prompt action was taken to address the incident, including performing a password reset to prevent further unauthorized access. A third-party cybersecurity firm has also been engaged to help improve its security controls.

Allegheny Health Network has reported the breach to the HHS’ Office for Civil Rights using a placeholder of 500 records until the breach is fully investigated and the number of individuals affected is known. Local media outlets have said around 8,000 individuals were affected.

Central Maine Medical Center Affected by Shields Healthcare Group Data Breach

Central Maine Medical Center (CMMC) has confirmed it has been affected by a data breach at Shields Healthcare Group. CMMC was one of 56 facility partners to be affected by the breach, which affected around 2 million individuals, including 11,938 CMMC patients. Further information on the breach is available in this post.

Granbury Eye Clinic in Texas Victim of Eye Care Leaders Data Breach

Granbury Eye Clinic in Texas is the latest eye care provider to confirm it was affected by the Eye Care Leaders data breach, which involved the PHI of 16, 475 patients. The data breach is now known to have affected at least 39 eye care providers, with the breach total currently standing at 3,091,694 patients.

The post Data Breaches Reported by Allegheny Health Network, St. Luke’s Health System, & Goldsboro Podiatry appeared first on HIPAA Journal.

A major data breach has been reported that has affected dozens of healthcare, rehabilitation, and senior living facilities in Oregon, Washington, Nevada, Utah, Colorado, and Arizona, which are operated by companies that are part of the Wilsonville, OR-based group, Avamere Holdings.

Between January 19, 2022, and March 17, 2022, an unauthorized individual gained access to a third-party-hosted network that was used by Avamere Health Services, LLC. Avamere Health Services is a business associate of the Avamere Holdings group of companies and provides information technology services. The forensic investigation of the data breach confirmed that the individuals behind the attack exfiltrated files from its systems that contained the information of employees and patients, including names, addresses, dates of birth, driver’s license or state identification numbers, Social Security numbers, claims information, financial account numbers, medications information, lab results, and medical diagnosis/conditions information.

The exact nature of the cyberattack was not disclosed in the substitute breach notice, but it would appear that this was a ransomware attack and that the exfiltrated data has been published on the group’s data leak site. Avamere Health Services said its information technology department has been working with third-party cybersecurity experts to review its existing security measures and security will be enhanced to prevent any repeat attacks.

Avamere Health Services has reported the breach to the Department of Health and Human Services’ Office for Civil Rights as affecting 197,730 individuals and has now sent notifications to those individuals and has offered complimentary credit monitoring services. Avamere Health Services provided notifications on behalf of the 81 companies that it works with as a HIPAA business associate.

One of the 81 companies is Premere Infinity Rehab, LLC, which has also published its own substitute breach notice on behalf of a further 16 companies for which it acts as a HIPAA business associate. Premere Infinity Rehab has reported the breach to the HHS’ Office for Civil Rights as affecting 183,254 individuals.

It is currently unclear if the total of 380,984 individuals is the final breach total. Companies known to have been affected are detailed in the tables below.

Companies Affected by Avamere Data Breach

The post 96 Senior Living and Healthcare Facilities Affected by Avamere Data Breach appeared first on HIPAA Journal.

A round-up of data breaches that have recently been reported to the HHS’ Office for Civil Rights and state Attorneys General.

Californian EHR Vendor Reports Breach of 77,652 Records

Further information has been obtained on a data breach reported to the HHS’ Office for Civil Rights on June 2, 2022, by Clinivate, a Pasadena, CA-based provider of EHR solutions for behavioral health agencies and schools.

According to a breach notification to the California Attorney General, unusual activity was detected in its digital environment on March 23, 2022. A forensic investigation confirmed that an unauthorized third party had gained access to its network, and on May 25, 2022, it was determined that files containing the protected health information of individuals were accessed by that third party between March 12, 2022, and March 21, 2022.

The files included the protected health information of 77,652 individuals, including names, medical record numbers, health plan beneficiary numbers, treatment information, diagnosis information, other medical information, and information about payments for medical services.

Clinivate has notified affected individuals and said it has implemented additional security measures to prevent further data breaches.

McLaren Port Huron Hospital Confirms PHI of 49,000 Individuals Compromised in Cyberattack at MCG Health

McLaren Port Huron Hospital has said the protected health information of certain patients has been compromised in a cyberattack at one of its former business associates, MCG Health. MCG Health provides patient care guidelines to many health plans and almost 2,600 hospitals in the United States. On March 25, 2022, MCG Health discovered an unauthorized third party had obtained data from its network that included data elements such as names, Social Security numbers, medical codes, postal addresses, phone numbers, email addresses, dates of birth, and gender. Many MCG Health clients were affected by the incident.

McLaren Port Huron Hospital said it was notified about the breach on June 9, 2022, and that the delay in being notified meant it has not conducted its own investigation to determine the probability of an actual compromise of patient data but has sent notifications to all affected individuals to warn them of the possibility that their PHI has been stolen. McLaren Port Huron Hospital stopped using MCG Health in 2019.

The data breach has been reported to the HHS’ Office for Civil Rights as affecting 48,957 McLaren Port Huron Hospital patients. Affected individuals have been offered complimentary credit monitoring and identity theft protection services for 24 months.

Kaiser Permanente Reports Theft of iPad Containing PHI

Kaiser Permanente has started notifying certain individuals that some of their protected health information was stored on an iPad that was stolen from a locked storage area at the Kaiser Permanente Los Angeles Medical Center. An unknown individual broke into the storage area and stole the iPad, and also obtained the password that provided access to the device.

The device was used at a Kaiser Permanente COVID-19 testing site, and included photographs of COVID-19 specimen labels and protected health information such as names, medical record numbers, dates of birth, and the dates and locations of service. The theft was discovered the same day and Kaiser Permanente remotely deleted the data on the device, including all photographs.

Kaiser Permanente said it has moved devices containing PHI to a more secure location and has strengthened its internal practices and procedures. Kaiser Permanente said the iPad contained the protected health information of approximately 75,000 health plan members.

Blue Cross and Blue Shield of Massachusetts Reports Third-Party Data Breach

Blue Cross and Blue Shield of Massachusetts (BCBSofMA) has recently confirmed that a data breach at a business associate has exposed the protected health information of some of its health plan members. The breach occurred at LifeWorks US Inc, which provides services related to the administration of the Retirement Income Trust, which includes making payments to pension beneficiaries.

Around June 20, 2022, a former employee of LifeWorks emailed spreadsheets to a personal email account and copied the email to the personal email account of another former LifeWorks employee. The spreadsheets contained the protected health information of individuals who were eligible for or were receiving benefits from BCBSofMA.

The former employees maintained that the spreadsheets were sent to preserve the formula used, and that attempts were made to delete all protected health information in the spreadsheets; however, some PHI remained. The former employees said they did not further disclose the information in the spreadsheets and have now deleted the spreadsheets from their personal email accounts. The information that remained in the spreadsheets was limited to names, addresses, Social Security numbers, and some pension benefit information.

BCBSofMA has reported the breach as affecting 4,855 individuals and has offered 24 months of complimentary identity theft and credit monitoring services to affected individuals. LifeWorks said it is taking steps to prevent any recurrences of incidents such as this.

Business Associate Ransomware Attack Affects Blue Shield of California Health Plan Members

A subcontractor of a vendor used by Blue Shield of California (BSofC) has suffered a ransomware attack in which the protected health information of members of BSofC and the BSofC Promise Health Plan may have been accessed or obtained. The ransomware attack was detected on April 28, 2022, by OneTouchPoint (OTP), which was a subcontractor used by business associate Matrix Medical Network.

OTP said it immediately terminated the unauthorized access to the network and launched an investigation into the breach. While it could not be confirmed if files containing health plan members’ protected health information were viewed or obtained, the possibility could not be ruled out. The files potentially accessed included names, subscriber ID numbers, diagnoses, medications, patient addresses, dates of birth, sex, physician demographics information, advance directives, family histories, social histories, allergies, vitals, immunizations, encounter data, assessment ID numbers, and assessment dates.

The data breach has been reported to the HHS’ Office for Civil Rights as affecting 1,506 health plan members. Affected individuals have been offered a complimentary 12-month membership to a credit monitoring and identity theft protection service.

The post Recent Hacks, Malware, and Device Theft Incidents Affect 208,000 Individuals appeared first on HIPAA Journal.