The Bradenton, FL-based gastroenterology healthcare provider Florida Digestive Health Specialists (FDHS) has recently started notifying more than 212,000 patients that some of their protected health information has been exposed in a December 2020 cyberattack.

Notification letters were sent to affected individuals on December 27, 2021, by attorney Jason M. Schwent of Clark Hill. The letters explain that suspicious activity was detected in an employee email account on December 16, 2020, which involved an unauthorized individual sending emails from that account.

This was a business email compromise attack where access to an internal email account is gained, usually via a phishing email, and the account is then used to impersonate an employee to convince other individuals to make fraudulent wire transfers. In this case, on December 21, 2020, FDHS determined a fraudulent transfer of funds had been made to an unknown bank account.

FDHS engaged the services of Clark Hill and a third-party cybersecurity firm to investigate the cyberattack. The investigation confirmed a limited number of employee email accounts had been accessed by unauthorized individuals. Those accounts were described as “voluminous” and contained the personal and protected health information of 212,509 patients. In attacks such as this, the aim of the attack is to obtain payments through fraudulent wire transfers rather than to obtain patient data; however, data theft could not be ruled out.

The amount of data present in the compromised email accounts was provided as a reason for a 12-month delay in issuing notification letters to affected patients. FDHS said the review of the email accounts was time-consuming and only concluded on November 19, 2021.

In response to the breach, several changes were made to its IT systems to improve security. Those measures include a password reset across its IT environment, implementation of multifactor authentication, strengthening password protocols, and reconfiguring its firewall.

Affected individuals have been offered 12-months of complimentary credit monitoring and identity theft protection services.

The post Over 212,500 Patients Affected by 2020 Email Account Breach at Florida Digestive Health Specialists appeared first on HIPAA Journal.

The Medical Review Institute of America (MRoiA) suffered a suspected ransomware attack in November 2021 in which sensitive patient data were stolen.

MRoiA is provided with patient data by HIPAA-covered entities as part of the clinical peer review process of healthcare services. In a data breach notice provided to the Vermont attorney general, MRoiA said it was the victim of a sophisticated cyberattack that was detected on November 9, 2021. Third-party cybersecurity experts were immediately engaged to conduct a forensic investigation to determine the nature and scope of the attack and to assist with its remediation efforts, including restoring its systems and operations.

On November 12, 2021, MRoiA discovered the attackers had exfiltrated sensitive data, including patients’ electronic protected health information (ePHI). MRoiA did not state in the breach notification letter whether ransomware was involved, although the attack has the hallmarks of a double-extortion ransomware attack.

MRoiA said on November 16, 2021, it received assurances that the stolen data were retrieved and copies of the data have been deleted, which suggests the ransom demand was paid, although that has not been confirmed.

MRoiA said the investigation into the attack is ongoing and a review of the compromised files has been completed. Individuals affected by the attack have had their full names compromised in addition to one or more of the following data elements: Gender, home address, phone number, email address, date of birth, Social Security number, medical history, diagnosis, treatment information, dates of service, lab test results, prescription information, provider name, medical account number (and other data stored in medical files/records), health insurance information, and claims information.

MRoiA said that prior to the breach it had adopted the HITRUST Common Security Framework (CSF), was compliant with the requirements of HIPAA and the HITECH Act, and had secured its systems to prevent unauthorized access. In response to the breach, additional cybersecurity safeguards are being implemented. These include constant monitoring of systems using advanced threat hunting and detection software, implementing additional authentication procedures, hardening its backup environment, and enhancing employee cybersecurity training.

New servers were built from the ground up to ensure no further unauthorized access was possible and MRoiA is working with third-party cybersecurity experts to further improve its security posture. Affected individuals have been offered complimentary identity monitoring services.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Patient Data Stolen in Cyberattack on the Medical Review Institute of America appeared first on HIPAA Journal.

A hacker gained access to the IT network of Altamonte Springs, FL-based BioPlus Specialty Pharmacy Services and accessed files containing sensitive patient data. The intrusion was detected on November 11, 2021, and steps were immediately taken to remove the hacker from its network. Assisted by a third-party computer forensics firm, BioPlus determined its IT environment was compromised on October 25, 2021, and the hacker was removed from its systems on November 11.

The investigation confirmed files containing the protected health information of certain patients had been accessed, but it was not possible to rule out the possibility that the hacker accessed the PHI of all of its patients. The decision was therefore taken to notify all 350,000 current and former patients about the breach.

Files that were accessible to the hacker included patient names, dates of birth, addresses, medical record numbers, current/former health plan member ID numbers, claims information, diagnoses, and/or prescription information. Some patients also had their Social Security number exposed. Notification letters started to be mailed on December 10, 2021. Patients who had their Social Security number exposed have been offered complimentary credit monitoring and identity protection services. BioPlus said it has implemented additional safeguards to prevent similar breaches in the future.

IT Systems Still Down a Week After Cyberattack on Capital Region Medical Center

Capital Region Medical Center (CMRC) in Jefferson City, MO, has confirmed it was the victim of a cyberattack that forced the shutdown of its network and phone systems. The cyberattack was detected on December 17, 2021, and its network and phone system are still offline. The medical center is operating on its downtime procedures and patients are being seen, but certain appointments have been canceled. The cyberattack has also affected Capital Region’s pharmacies.

“While our information security team is working diligently to bring our systems back online as quickly, and securely, as possible, nothing is more important to us than the health and safety of our patients and continuing to provide the care our patients expect,” said Lindsay Huhman, CRMC director of marketing and communications, said in a news release. “There are downtime procedures in place for physicians, nurses, and staff to provide care in these types of situations, and our staff is committed to doing everything they can to mitigate disruption and provide uninterrupted care to our patients.”

5,356 Individuals Affected by Data Breach at Weddell Pediatric Dental Specialists

Weddell Pediatric Dental Specialists in Carmel, IN, has started notifying 5,356 individuals that an unauthorized individual gained access to an employee’s email account that contained their protected health information.

The email account breach was detected on July 23, 2021, and the account was immediately secured. Assisted by third-party cybersecurity professionals, the dental practice confirmed the breach was limited to one employee email account. The review and analysis of emails and attachments in the account were completed on October 27, 2021, and revealed the account contained patient names, along with one or more of the following data elements: date of birth, medical diagnosis, medical treatment information, financial account information and in some instances Social Security numbers.

Individuals who had their Social Security number exposed have been offered complimentary credit monitoring services for 12-months. Weddell Pediatric Dental Specialists said no information has been received to indicate any patient data has been misused.

The post Hospital, Pharmacy, and Dental Practice Report Hacking Incidents Impact More Than 355,000 Patients appeared first on HIPAA Journal.

Morgantown, WV-based Monongalia Health System has started notifying almost 400,000 patients that some of their protected health information (PHI) may have been obtained by unauthorized individuals in a recent cyberattack.

The security incident came to light when one of its vendors reported not receiving a July 2021 payment that had left Monongalia Health’s accounts. The investigation into the incident confirmed this was a business email compromise (BEC) attack. The attacker had used a phishing email to obtain the credentials for a Monongalia Health contractor’s email account, which was used to send a request to Monongalia Health to have the bank account details for an upcoming payment changed to an account controlled by the attacker.

Monongalia Health said the investigation revealed several Monongalia Health email accounts had been compromised as a result of employees responding to phishing emails, and emails and email attachments in those accounts contained patients’ protected health information. The purpose of the attack appears to have solely been to obtain funds from Monongalia Health through fraudulent wire transfers, rather than to steal sensitive data.

The investigation confirmed several employee email accounts had been accessed by unauthorized individuals between May 10, 2021, and August 15, 2021, and while no evidence of data theft has been identified, unauthorized accessing of patients’ protected health information could not be ruled out. Monongalia Health said the data breach was limited to its email system and electronic medical records were unaffected. A review of the emails and attachments in the compromised accounts revealed they contained the PHI of patients of Monongalia County General Hospital and Stonewall Jackson Memorial Hospital. The PHI of patients of other Monongalia Health hospitals does not appear to have been compromised.

The exposed PHI included names, addresses, dates of birth, patient account numbers, health insurance plan member ID numbers, medical record numbers, dates of service, provider names, claims information, medical and clinical treatment information, status as a current or former Mon Health patient, and Medicare health insurance claim numbers, which could contain Social Security numbers.

Monongalia Health said it will be reviewing and enhancing its existing security protocols and practices and will implement multi-factor authentication for remote access to its email system. The HHS’ Office for Civil Rights Breach Portal indicates up to 398,164 individuals have been affected.

The post PHI of Almost 400,000 Monongalia Health Patients Potentially Compromised in BEC and Phishing Attack appeared first on HIPAA Journal.

Paducah, KY-based Southern Orthopaedic Associates (SOA) has started notifying 106,910 patients about a breach of some of their protected health information.

SOA detected unauthorized activity in an employee email account on or around July 8, 2021. Steps were immediately taken to secure the account and an investigation was launched to determine the nature and scope of the breach. Assisted by a third-party computer forensics company, SOA determined that several employee email accounts had been compromised between June 24, 2021, and July 8, 2021; however, it was not possible to tell which, if any, emails in the account had been accessed.

A comprehensive review was conducted of all emails and attachments in the compromised accounts to determine if they contained any protected health information. The review was completed on October 21, 2021, and confirmed the accounts contained patient names and Social Security numbers.

Notification letters were sent to affected individuals starting on December 12, 2021. SOA has offered a complimentary 1-year membership to credit monitoring services through Experian, has implemented additional safeguards to improve email security, and has provided further security awareness training to the workforce.

Eduro Healthcare Data Breach Affects More Than 8,000 Patients

Salt Lake City, UT-based Eduro Healthcare has notified 8,059 patients about a potential breach of their protected health information. In March 2021, suspicious activity was detected in its network and action was immediately taken to contain the breach.  The healthcare provider implemented its incident response plan which allowed it to quickly restore access to its network.

Euro Healthcare said the prompt action taken in response to the breach was believed to have prevented unauthorized individuals from accessing and exfiltrating patient information; however, on August 24, 2021, Eduro Healthcare discovered some patient data had been exfiltrated and posted on a dark web data leak site.

Then commenced a painstaking process of identifying the individuals affected and the types of data that had been compromised. That process was completed on October 21, 2021. The data compromised included first and last names, dates of birth, provider name, date(s) of service, treatment information, Social Security numbers, and health insurance information.

Affected individuals have been offered 12 months of complimentary credit monitoring and identity restoration services through IDX and will be protected by a $1,000,000 identity theft insurance policy. Eduro Healthcare has implemented additional security controls, conducted a complete audit of all accounts, strengthened password protocols, reconfigured its firewall, implemented multi-factor authentication on email accounts, and updated its network security protocols and procedures.

The post Hacking Incidents Reported by Southern Orthopaedic Associates and Eduro Healthcare appeared first on HIPAA Journal.

Texas Ear, Nose & Throat Specialists P.A. (Texas ENT Specialists) has recently announced it was the victim of a cyberattack that was detected on October 19, 2021.

When the attack was detected, prompt action was taken to prevent further unauthorized system access and a third-party cybersecurity firm was engaged to investigate and determine the nature and extent of the attack. The forensic investigation revealed the attackers first gained access to its systems on August 9, 2021, and between then and August 15, files were copied and exfiltrated from its systems.

A review of those files confirmed they contained the protected health information (PHI) of 535,489 patients, including names, dates of birth, medical record numbers, and procedure codes. A subset of individuals also had their Social Security numbers stolen; however, its electronic medical record system was unaffected.

Texas ENT Specialists mailed notification letters to affected individuals on December 10, 2021. Patients who had their Social Security number stolen have been offered complimentary membership to Experian’s identity theft monitoring service.

Texas ENT Specialists said has strengthened its privacy and information security program and has implemented additional technical security measures to better protect and monitor its systems.

Virginia Department of Behavioral Health and Developmental Services Suffers Second Funding Portal Breach

The Virginia Department of Behavioral Health and Developmental Services (DBHDS) is notifying 4,037 individuals who applied for Individual and Family Support Program (IFSP) funding that some of their protected health information may have been impermissibly disclosed. The breach affected its IFSP Funding Portal and occurred on October 7, 2021. The breach was detected within minutes and the portal was immediately taken offline to prevent further unauthorized data access.

In 2019, DBHDS experienced a breach of its IFSP funding portal that exposed the data of 1,442 individuals. In the 17 months that followed, the internal team and the Virginia Information Technology Agency (VITA) investigated the attack and attempted to simulate and solve the issue. Extensive testing of the Portal was performed, and it was determined the Portal was clear to operate again. The latest breach appears to be similar to the 2019 incident and may also have allowed information to be viewed by other applicants.

DBHDS said it will not attempt to repair the Portal again, and an alternative solution will be found for future IFSP application processes. Individuals who had their application information exposed to other individuals will be able to sign up for free credit monitoring services for 2 years.

The post Over 535,000 Individuals Affected by Ransomware Attack on Texas ENT Specialists appeared first on HIPAA Journal.