HIPAA Breach News

American Dental Association and Tenet Healthcare Recovering from Cyberattacks

Posted by HIPAA Journal

The American Dental Association (ADA) suffered a cyberattack on Friday and has been forced to take many of its systems offline. The ADA website is currently available and explains that “The ADA is experiencing technical difficulties,” and that work is underway to get its systems running smoothly. While the website does not provide any further information on the cause of the technical difficulties, emails have been sent to ADA members advising them about the cyberattack.

The letters explain that parts of its network were taken offline and that Aptify, ADA email, the telephone system, and web chat have all been affected. Many of its online services are currently unavailable; however, details of the attack have not been shared at this time.

The ADA said it has reported the cyberattack to law enforcement and it is investigating the nature and scope of the attack and is being assisted by third-party cybersecurity professionals. The investigation has not uncovered any evidence of data theft at this stage and the extent to which its members, dental practices, and other dental organizations have been affected is not known. Several state dental associations have also reported on their websites that technical difficulties are being experienced, including the New York and Florida Dental Associations.

While little information has been made public about the exact nature of the attack, it has the hallmarks of a ransomware attack. According to Bleeping Computer, a new ransomware operation – Black Basta – has claimed responsibility for the cyberattack and has published a sample of the stolen data on its data leak site. Black Basta claims the leaked data is around 30% of what was stolen from the ADA and includes employee information, financial information, and other sensitive data.

Black Basta is a new ransomware group that started conducting attacks in the middle of April 2022, with the first known victim being the German wind farm operator, Deutsche Windtechnik. The ransomware encrypts files using AES+RSA algorithms and adds the .basta extension to encrypted files. The group claims in its ransomware notes that data has been stolen and will be published on its TOR website if the ransom is not paid. The desktop on victim devices is replaced with an image stating, “your network is encrypted by Black Basta group,” and a readme.txt file is dropped on the desktop with instructions for recovering files.

Tenet Healthcare Confirms Recent Cyberattack

The Dallas, TX-based multinational health system Tenet Healthcare, which operates 620 facilities in 34 states including 60 hospitals, is currently recovering from a cyberattack that disrupted some of its acute care operations.

The attack occurred last week, and the health system says most critical functions have now been restored and normal operations are starting to be resumed at the affected locations. Tenet explained on its website in an April 26, 2022 post that user access was immediately suspended on the affected technology applications when the cyberattack was detected, its cybersecurity protocols were immediately implemented, and rapid action was taken to prevent further unauthorized access to its systems.

Tenets said, “Efforts to restore impacted information technology operations continue to make important progress,” and that all of its healthcare facilities remained operational and continued to deliver patient care safely, using well-established backup processes. An investigation has been launched to determine the nature and scope of the cyberattack, and that investigation is ongoing. It is currently unclear to what extent, if any, patient and employee data has been affected.

The post American Dental Association and Tenet Healthcare Recovering from Cyberattacks appeared first on HIPAA Journal.

Solara Medical Supplies Proposes $5 Million Settlement to Resolve Class Action Data Breach Lawsuit

Posted by HIPAA Journal

A preliminary settlement has recently been approved by a California Federal court to resolve a consolidated class action lawsuit against Solara Medical Supplies.

Solara Medical Supplies is a Chula Vista, California-based direct-to-consumer provider of medical devices and disposable medical products and a registered pharmacy. On June 28, 2019, Solara Medical identified suspicious activity in an employee email account. The subsequent investigation confirmed unauthorized individuals had gained access to multiple Office 365 email accounts between April 2, 2019, and June 20, 2019, as a result of employees responding to phishing emails.

The forensic investigation confirmed that the sensitive information of 114,007 of its customers had been exposed and potentially stolen, including names, dates of birth, Social Security numbers, driver’s license numbers, health insurance information, and financial information. Affected individuals were offered complimentary credit monitoring and identity theft protection services for 12 months.

Four class action lawsuits were filed on behalf of the affected customers, and those lawsuits were consolidated into a single lawsuit. Solara Medical proposed the settlement to resolve the lawsuit to avoid ongoing legal costs; however, denied any wrongdoing. The settlement dismisses the lawsuit with prejudice and does not constitute any admission of fault, wrongdoing, or liability.

Under the terms of the settlement, Solar Medical has agreed to pay $5,060,000 to cover claims from the plaintiffs and class members and will take steps to improve data security to prevent further security breaches.  The six plaintiffs named in the lawsuits will be paid $4,000 each, and all class members who file timely claims will receive $100, plus a pro rata payment of up to $1,000 if any funds remain in the fund after the $100 cash payments have been made. The settlement amount includes $2.3 million in attorneys’ fees. If any funds remain, they will be donated to the Juvenile Diabetes Research Foundation.

For the next two years, Solara Medical will undergo a SOC 2 Type 2 audit, which will be repeated until it is passed, engage an independent third party to perform a HIPAA IT assessment, conduct at least one cybersecurity incident response test a year, undergo third-party phishing and external-facing vulnerability tests at least twice a year. Solara Medical will also implement a security information event and management (SIEM) tool with a 400-day lookback on activity logs. Improved versions of the remedial actions or the same actions will be conducted to new industry standards for the subsequent three years.

The post Solara Medical Supplies Proposes $5 Million Settlement to Resolve Class Action Data Breach Lawsuit appeared first on HIPAA Journal.

PHI Exposed in Security Incidents at Georgia Pines CSB & Ballad Health

Posted by HIPAA Journal

Security incidents have recently been reported by Georgia Pines CSB and Ballard Health, which have included the protected health information (PHI) of 28,295 individuals.

Ballad Health Discovers Breach of Employee Email Account

Ballard Health, an integrated community health improvement organization serving communities in the Appalachian Highlands in Northeast Tennessee, Southwest Virginia, Northwest North Carolina, and Southeast Kentucky, has recently discovered an unauthorized individual has accessed the email account of one of its employees.

Suspicious activity was detected in the email account of an employee on or around January 13, 2022. The email account was immediately secured, and a forensic investigation was conducted to determine the nature and scope of the breach. On February 17, 2022, it was determined that the email account was accessed for a short period by an unauthorized individual who may have viewed or acquired information in the account.

A review of the emails in the account confirmed on March 16, 2022, that they included the protected health information of 4,295 patients, such as names, dates of birth, medical histories, medical conditions, treatment information, medical record numbers, diagnosis codes, and patient account numbers. It was not possible to tell which emails, if any, had been viewed or obtained.

Ballard Health said it will continue to educate the workforce on the importance of security measures that must be taken by employees to protect its email system.

Laptops Stolen from Georgia Pines Community Service Board

Two laptop computers containing the protected health information of up to 24,000 patients were stolen in a break-in at Georgia Pines Community Service Board (CSB) at some point between April 6 and April 7, 2022. Georgia Pines CBS staff discovered the break-in at its main campus on the morning of April 7, 2022.

The laptops contained files that included protected health information such as names, addresses, Social Security numbers, and medical records. No evidence has been found to indicate any information on the laptops has been viewed or misused by unauthorized individuals, but unauthorized access and misuse cannot be ruled out.

Notification letters started to be sent to affected individuals on April 7, 2022.

The post PHI Exposed in Security Incidents at Georgia Pines CSB & Ballad Health appeared first on HIPAA Journal.

Adaptive Health Integrations Data Breach Affects More than 510,000 Individuals

Posted by HIPAA Journal

An Adaptive Health Integrations data breach has recently been reported to the Department of Health and Human Services’ Office for Civil Rights (OCR) that involved the protected health information (PHI) of 510,574 individuals.

Adaptive Health Integrations is listed as a Williston, North Dakota-based provider of LIS software services and billing/revenue services to laboratories, physician offices, and other healthcare companies. The notification letters, a copy of which was found on the Montana Attorney General website, state that the company recently became aware that an unauthorized individual had gained access to its system on or around October 17, 2021, and may have accessed “a limited amount of data stored on our systems.”

The letters explained that when the unauthorized access was discovered, the threat was immediately contained, and an investigation was launched. A comprehensive review of affected files was conducted, and that process was concluded on February 23, 2022. The notification letters state that credit monitoring, fraud consultation, and identity theft restoration services are being offered through Kroll for 12 months at no cost.

The notification letters do not provide any information about who Adaptive Health Integrations is or why they hold individuals’ PHI. Some individuals who received a notification letter have posted online questing the legitimacy of the notification letters, which were written on paper with a photocopied company logo. After checking the company website some have posted that they think this is a scam.

A Google search for the company returns a result that is a 2-page site that has a placeholder for the contact us page that includes dummy text. There is no mention of a data breach on the company website at the time of issuing notifications.

The law firm Migliaccio & Rathod LLP says it has started an investigation into the Adaptive Health Integrations data breach.

This post will be updated when further information becomes available.

The post Adaptive Health Integrations Data Breach Affects More than 510,000 Individuals appeared first on HIPAA Journal.

March 2022 Healthcare Data Breach Report

Posted by HIPAA Journal

For the fourth successive month, the number of reported healthcare data breaches has fallen. In March 2022, 43 healthcare data breaches of 500 or more records were reported to the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR), which is a 6.52% fall from February and well below the 12-month average of 57.75 data breaches a month.

healthcare data breaches past 12 months - March 2022

However, there was a 36.94% increase in the number of breached records compared to February. Across the 43 reported breaches, 3,083,988 healthcare records were exposed, stolen, or impermissibly disclosed, which is slightly below the average of 3,424,818 breached records a month over the past 12 months.

number of breached healthcare recovers over the past 12 months - March 2022

Largest Healthcare Data Breaches in March 2022

In March 2022, there were 25 data breaches reported to OCR that affected 10,000 or more individuals, all but one of which were hacking incidents. The largest data breach of the month affected over half a million patients. Christie Business Holdings Company, which operates Christie Clinic in Illinois, discovered an employee email account had been accessed by unauthorized individuals and was used in a business email compromise (BEC) attack to try to divert payment to a third-party vendor. BEC attacks may account for a relatively small percentage of healthcare data breaches, but according to figures from the FBI, they are the biggest cause of losses to cybercrime.

SuperCare Health reported a major breach from July 2021 where hackers accessed its network and potentially stole patient data. Around two weeks after announcing the data breach the first lawsuit against SuperCare Health was filed. There is often a rush to file lawsuits following healthcare data breaches, and it is now common for multiple lawsuits to be filed.

CSI Laboratories reported a cyberattack that was discovered in February. While the nature of the attack was not disclosed, the Conti ransomware gang claimed responsibility for the attack and published a sample of the stolen data on its data leak site to pressure the lab into paying the ransom. Double extortion tactics, where payment is required for the keys to decrypt files and to prevent the publication of stolen data, are now the norm in ransomware attacks.

Name of Covered Entity State Covered Entity Type Individuals Affected Breach Cause
Christie Business Holdings Company, P.C. IL Healthcare Provider 502,869 Hacked email account
Super Care, Inc. dba SuperCare Health CA Healthcare Provider 318,379 Unspecified hacking incident
Cytometry Specialists, Inc., d/b/a CSI Laboratories GA Healthcare Provider 312,000 Ransomware attack (Conti)
South Denver Cardiology Associates, PC CO Healthcare Provider 287,652 Unspecified hacking incident
Clinic of North Texas, LLP TX Healthcare Provider 244,174 Unspecified hacking incident
Taylor Regional Hospital KY Healthcare Provider 190,209 Unspecified hacking incident
Chelan Douglas Health District WA Healthcare Provider 188,236 Unspecified hacking and data theft incident
Urgent Team Holdings TN Healthcare Provider 166,601 Unspecified hacking incident
New Jersey Brain and Spine NJ Healthcare Provider 92,453 Unspecified hacking incident
Duncan Regional Hospital, Incorporated OK Healthcare Provider 86,379 Unspecified hacking incident
Labette Health KS Healthcare Provider 85,635 Unspecified hacking incident
Law Enforcement Health Benefits, Inc. PA Health Plan 85,282 Ransomware attack
Central Indiana Orthopedics IN Healthcare Provider 83,705 Unspecified hacking incident
Highmark Inc PA Health Plan 67,147 Hacking incident at mailing vendor
Advanced Medical Practice Management NJ Business Associate 56,427 Unspecified hacking and data theft incident
Charleston Area Medical Center, Inc. WV Healthcare Provider 54,000 Hacked email accounts (Phishing)
Resources for Human Development PA Healthcare Provider 46,673 Theft of unencrypted hard drive
Cancer and Hematology Centers of Western Michigan MI Healthcare Provider 43,071 Ransomware attack
Horizon Actuarial Services, LLC GA Business Associate 38,418 Unspecified hacking and data theft incident
Central Minnesota Mental Health Center MN Healthcare Provider 28,725 Hacked email accounts
Capital Region Medical Center MO Healthcare Provider 17,578 Unspecified hacking incident
Dialyze Direct, LLC NJ Healthcare Provider 14,203 Hacked email account
Major League Baseball Players Benefit Plan MD Health Plan 13,156 Unspecified hacking and data theft incident at a business associate
Colorado Physician Partners, PLLC CO Healthcare Provider 12,877 Hacked email account
Crossroads Health OH Healthcare Provider 10,324 Unspecified hacking and data theft incident

Causes of March 2022 Healthcare Data Breaches

The healthcare data breaches reported in March were dominated by hacking/IT incidents, which accounted for 90.7% of all data breaches reported and 98.3% of the breached healthcare records. 3,083,988 individuals were affected by those hacking incidents. The average breach size was 77,766 records and the median breach size was 17,758 records.

Causes of MArch 2022 healthcare data breaches

While the category “hacking/IT incidents” covers a broad range of causes, 31 of the incidents involved hackers gaining access to network servers where patient data was stored. 10 incidents involved unauthorized individuals gaining access to employee email accounts.

 

There were just three breaches reported as unauthorized access/disclosure incidents which involved a total of 4,447 records. The average breach size was 1,482 records and the median was 1,682 records. There was only one theft incident reported – a hard drive containing the records of 46,673 individuals was stolen.

Location of breached PHI in March 2022 healthcare data breaches

March 2022 Healthcare Data Breaches by State

HIPAA-regulated entities in 22 states and Puerto Rico reported data breaches in March 2022. New Jersey, Pennsylvania & Texas were the worst affected states with 4 breaches reported in each state.

State Number of Reported Data Breaches
New Jersey, Pennsylvania & Texas 4
Colorado, Georgia, Indiana, Kansas, Michigan, Minnesota, Washington, West Virginia, and Puerto Rico 2
California, Illinois, Kentucky, Maryland, Massachusetts, Missouri, New York, Ohio, Oklahoma, Tennessee, and Utah 1

HIPAA Enforcement Activity in March 2022

There were no HIPAA enforcement actions announced by the HHS’ Office for Civil Rights or state attorneys general in March 2022.

The post March 2022 Healthcare Data Breach Report appeared first on HIPAA Journal.

On-the-spot Email Interventions Reduce Repeat Medical Record Snooping Incidents by 95%

Posted by HIPAA Journal

Immediate intervention following an instance of unauthorized access to protected health information (PHI) by a healthcare employee is 95% effective at preventing repeat offenses, according to a new study published in JAMA Open Network.

Healthcare data breaches are occurring at record levels, and while large data breaches are often the result of hacking and other IT incidents, insider breaches such as snooping on medical records are common. According to HHS data, in 2019, 92% of combined small and large breaches were tied to unauthorized access.

While many cases of employees snooping on the medical records of VIP patients have been covered in the media, these types of snooping incidents are relatively uncommon. It is much more common for healthcare employees to access the medical records of family members, friends, and colleagues, and those privacy violations can be just as damaging for patients.

All cases of unauthorized access start with an employee accessing a single patient record, but they can easily turn into major data breaches if left unchecked. There have been several cases of healthcare employees accessing the medical records of thousands of patients without authorization over several years when the unauthorized access is not promptly identified and addressed.

A study conducted by Bai, Jiang, and Flasher in 2017 found the risk of data breaches was higher at large academic medical centers than at other hospitals. Around one-quarter of the data breaches were cases of employees accessing patient information without authorization.

The recent study, Effectiveness of Email Warning on Reducing Hospital Employees’ Unauthorized Access to Protected Health Information: A Nonrandomized Controlled Trial, conducted by researchers at Michigan State University, Johns Hopkins, and Nick Culbertson, CEO and Co-founder of the healthcare compliance analytics firm Protenus, investigated the effectiveness of email warnings at preventing repeat offenses by employees.

Between January 1 and July 31, 2018, a system that monitored unauthorized accessing of PHI at a large academic medical center flagged unauthorized accessing of electronic medical records by 444 employees, all of whom were professional medical staff who were not part of the patient’s intervention team and did not have access permission.

A group of 219 employees was randomly selected and received an email warning on the night of their access. The email explained that the individual had been identified as having accessed a patient’s electronic medical record when there was no work-related reason for doing so, and that it was a privacy violation. The remaining 225 employees formed a control group and received no email warning.

In the group that received an email intervention, 4 employees out 219 went on to access patient information without authorization on a second occasion between 20 and 70 days after the initial unauthorized access. In the control group, 90 out of the 225 employees accessed the protected health information of patients again without authorization between 20 and 70 days after the initial unauthorized access.

While there were limitations of the study and the findings may not translate to other hospitals, it demonstrates that on-the-spot intervention can be highly effective at preventing further privacy breaches and that if no action is taken, employees are likely to continue to access patient data in violation of the HIPAA Rules.

“What an email warning can do to deter employees’ unauthorized access is stunning. A simple email can lead to big changes,” said Dr. Ge Bai, a professor at Johns Hopkins Carey Business School and Bloomberg School of Public Health, and corresponding author of the study.

For the duration of the trial, no disciplinary action was taken against any of the employees. Disciplinary action was taken after the trial was concluded against all employees involved for violating the PHI access policy of the medical center, which prohibits employees from accessing the records of family members, coworkers, friends, or other acquaintances without prior written authorization.

The post On-the-spot Email Interventions Reduce Repeat Medical Record Snooping Incidents by 95% appeared first on HIPAA Journal.

Deaconess Health System and Blue Earth County Notify Patients About Insider Data Breaches

Posted by HIPAA Journal

Indiana-based Deaconess Health System and Blue Earth County in Minnesota have notified individuals that sensitive personal information has been accessed by employees without authorization.

Deaconess Health System Notifies Female Patients About Unauthorized Medical Record Access by Physician

A physician formerly employed by Deaconess Health System in Evansville, IN, has been discovered to have accessed the medical records of female patients without authorization.

On January 26, 2022, the unauthorized medical record access was discovered by Deaconess Health System during a routine audit of access logs. According to the law firm Ladendorf Law of Indianapolis, which spoke with six women who were notified about the privacy breach by Deaconess Health System, the unauthorized first occurred no later than June 2020.

According to attorney Taylor Ivy, all six of the women said the first contact occurred in bars in the West Side of the city. The physician had approached them and started talking to them and obtained information about them during the encounter. It appears that the physician looked up the women in the medical record system after the initial encounter.

The law firm said one woman was notified by Deaconess Health System that her medical records had been accessed by the physician on eight occasions between June 2020 and December 2021 for non-work-related reasons. The records contained personal information, contact information, and her medical history. Deaconess Health System apologized for the breach and offered the woman complimentary online identity theft protection for 12 months. One of the women said the physician turned up at her place of work and gave her a written note.

Deaconess Health System said that when the breach was discovered, the physician was permanently terminated. The incident has not appeared on the HHS’ breach portal at this stage. Since the breach notification letter posted on Facebook by the law firm was dated February 23, 2022, that suggests the unauthorized access involved fewer than 500 records. The law firm has requested any person who has been notified about the breach make contact with them, as claims may be pursued.

Insider Breach at Blue Earth County Human Services Department

An employee of the Blue Earth County Human Services Department was discovered to have accessed the private information of individuals without authorization between June 5, 2020, and May 24, 2021. When the unauthorized access was discovered, the individual was placed on administrative leave pending the outcome of the investigation. The review of access logs confirmed the employee had accessed the personal information of 222 individuals without authorization. The database that was accessed included individuals’ names, addresses, medical histories, and Social Security numbers. After the investigation concluded, the employee resigned from their position.

Officials at Blue Earth County said no evidence was found to indicate any information was copied from its systems or sold to third parties, and this appears to have been a case of the employee snooping on records.

The post Deaconess Health System and Blue Earth County Notify Patients About Insider Data Breaches appeared first on HIPAA Journal.

Email Account Breaches Reported by Newman Regional Health and Contra Costa County

Posted by HIPAA Journal

Newman Regional Health (NRH), which operates a 25-bed critical access hospital in Emporia, KS, has recently started notifying 52,224 patients that unauthorized individuals have gained access to certain employee email accounts that contained protected health information.

NRH explained on its website that a limited number of employee email accounts were accessed by unauthorized individuals over a period of 10 months in 2021 between January 26, 2021, and November 23, 2021. When the security breach was identified, prompt action was taken to secure the accounts and an investigation was launched to determine the extent and nature of the breach.

NRH said a review of the emails in the compromised accounts confirmed on March 14, 2022, that the following types of patient information had been exposed: Names, dates of birth, medical record/ID numbers, addresses, phone numbers, e-mail addresses, and limited heath, treatment or insurance information, and for employees, information collected in connection with an individual’s receipt of services from or employment with NRH. A subset of individuals also had their Social Security number or financial information exposed.

The types of information exposed varied from individual to individual, and no evidence of fraudulent activity as a result of the breach has been identified at the time of issuing notification letters.  NRH said it has implemented additional measures to enhance security.

Contra Costa County Reports Email Account Security Incident

Contra Costa County in California has announced a breach of employee email accounts and the exposure of sensitive personal information. The forensic investigation of the breach revealed employee email accounts had been accessed by unauthorized individuals between June 24, 2021, and Aug. 12, 2021.

According to the substitute breach notice on the Contra Costa County website, the email accounts contained information on employees and individuals who had previously contacted the County’s Employment and Human Services Department. The types of information exposed included names, Social Security numbers, driver’s license numbers, state-issued I.D. numbers, financial account numbers, passport numbers, medical information, and/or health insurance information.

While unauthorized email account access was confirmed, it was not possible to tell if any emails or attachments in the accounts had been viewed or downloaded. It is unclear when the breach was detected; however, Contra Costa County said the breach investigation concluded on March 11, 2022, and notification letters were sent to affected individuals on April 15, 2022. Complimentary credit monitoring services have been offered to eligible individuals.

The breach has not yet appeared on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected.

The post Email Account Breaches Reported by Newman Regional Health and Contra Costa County appeared first on HIPAA Journal.

Urgent Team Holdings Reports Breach of the PHI of 166,600 Individuals

Posted by HIPAA Journal

Urgent Team Holdings, which operates more than 70 urgent care and walk-in centers in Alabama, Arkansas, Georgia, Mississippi, and Tennessee, has recently notified 166,601 patients that some of their protected health information may have been obtained by unauthorized individuals in a November 2021 cyberattack.

Urgent Team said it discovered its network had been compromised between November 12, 2021, and November 18, 2021. Assisted by third-party cybersecurity experts, Urgent Team discovered files may have been exfiltrated from its systems that contained the protected health information of patients. A comprehensive review of the files was completed on January 31, 2022, and confirmed they contained patients’ full names, dates of birth, and medical record numbers.

While data theft may have occurred, no evidence of data exfiltration was identified and there have been no reports of any misuse of patient data. To improve security, Urgent Team has implemented multi-factor authentication and has added extra layers of security to its systems to reduce the risk of unauthorized access. A new antivirus solution has also been implemented which generates alerts when there are any attempts by unauthorized individuals to access its systems.

The Guidance Center Reports Email Account Breach

The Guidance Center, Inc. has recently discovered unauthorized individuals gained access to several employee email accounts for a short period of time. Upon discovery of the breach, the email accounts were immediately secured, and an investigation was launched to determine the nature and scope of the attack.

Third-party cybersecurity consultants were engaged to assist with the investigation and to confirm the security of its computer systems and additional security measures have now been adopted to prevent further attacks. A review of the affected email accounts revealed they contained patients’ protected health information. The types of exposed information varied from individual to individual and may have included names in combination with one or more of the following data elements: medical treatment or diagnosis information, health insurance information, and/or patient record numbers.

The breach has been reported to the HHS’ Office for Civil Rights as affecting 23,104 individuals. Complimentary identity protection and credit monitoring services have been offered to certain individuals, based on the types of information that were exposed.

MetroHealth Announces Exposure of the PHI of 1,700 Patients

MetroHealth System in Cleveland, OH, has notified approximately 1,700 patients that some of their protected health information has been impermissibly disclosed to other patients due to an error that occurred during the upgrading of its electronic health record (EHR) system.

A misconfiguration meant that when patient records were generated to be sent to patients, data relating to other patients was inadvertently included in the records, such as patient names, appointment information, and the providers they saw. No other personal, financial, or health information was involved.

The issue was identified by the EHR provider, which notified MetroHealth about the data breach on February 10, 2022. Notification letters were sent to affected individuals on April 11.

The post Urgent Team Holdings Reports Breach of the PHI of 166,600 Individuals appeared first on HIPAA Journal.