The Winston-Salem, NC-based managed behavioral health organization, Carolina Behavioral Health Alliance (CBHA), the administrator of behavioral health benefits for Wake Forest University and Wake Forest Baptist Medical Center, has recently announced it was the victim of a ransomware attack.

The attack was detected on March 20, 2022, and resulted in computer systems being disabled. The forensic investigation of the incident confirmed the attackers had to its systems between March 19 and March 20 and may have viewed or obtained the sensitive data of 130,000 health plan members and their dependents, including names, addresses, health plan ID numbers, genders, and Social Security numbers.

To date, no reports have been received to indicate there has been any actual or attempted misuse of patient data. CBHA said it has implemented additional safeguards to better protect the data of health plan members in the future and has offered affected individuals access to single bureau credit monitoring, credit reporting, and credit score services for 24 months.

ATC Healthcare Announces Email Data Breach

ATC Healthcare in New York has recently confirmed that the email accounts of certain employees were accessed by unauthorized individuals, who may have viewed or obtained sensitive patient data. The incident was detected on December 22, 2021, when suspicious activity was identified within its email environment. The forensic investigation confirmed that several employee email accounts had been accessed by unauthorized individuals at various points between February 9, 2021, and December 22, 2021.

The affected email accounts included names, Social Security numbers, driver’s licenses, financial account information, usernames and passwords, passport numbers, biometric data, medical information, health insurance information, electronic/digital signatures, and employer-assigned identification numbers.

ATC Healthcare said it found no evidence to suggest patient information was accessed, exfiltrated, or misused, and that notification letters were sent to all individuals potentially affected. It is currently unclear how many individuals have been affected by the data breach.

Employee Email Account Compromised at Community of Hope D.C.

Community of Hope D.C. (COHDC) has discovered the email account of an employee has been accessed by an unauthorized third party, who may have viewed or obtained patients’ protected health information. The breach was detected when the email account was used to send spam emails. The forensic investigation confirmed the breach was limited to a single employee email account, which was breached between January 27, 2022, and February 7, 2022.

The account contained names, Social Security numbers, driver’s license numbers, financial information, health insurance information, and health diagnostic information. 645 individuals have been affected by the breach and have been offered complimentary credit monitoring and identity theft protection services.

The post Carolina Behavioral Health Alliance Reports Breach of the PHI of 130,000 Health Plan Members appeared first on HIPAA Journal.

Montana-based Associated Eye Care Providers (AEC) has recently started notifying patients that their private health information was compromised in a data breach at a business associate that was detected in early December 2020.

The data breach in question occurred at Netgain Technologies, which provided managed IT services to many organizations in the healthcare sector. Netgain Technologies experienced a ransomware attack in which files containing sensitive data were stolen. Netgain paid the ransom to prevent any further disclosure of the stolen data and received assurances from the ransomware gang that the stolen data had been deleted.

Netgain Technologies notified affected healthcare clients in January 2021, and those entities started to issue notification letters to affected patients over the next couple of months. While some affected healthcare clients took longer to issue notifications, it has now been 18 months since Netgain started notifying affected clients.

According to the AEC notification letter – dated July 8, 2022 – “Upon notification by Netgain to AEC, we worked with our information technology (IT) support team and engaged a law firm specializing in cybersecurity and data privacy to investigate further.” An extensive data mining project was then conducted to determine which individuals had been affected, and that process was completed on May 16, 2022.  After verifying contact information, notification letters were sent in July. AEC did not disclose when it was informed by Netgain about the data breach.

AEC said names, addresses, Social Security numbers, and medical histories had been exposed and potentially stolen, but there have been no reports of any actual or attempted misuse of patient data as a result of the data breach. In response to the breach, AEC replaced Netgain as its hosting vendor, migrated all data to another service provider, and has taken steps to introduce further safeguards to prevent any similar attacks in the future. AEC has offered affected individuals complimentary credit monitoring services.

The Netgain Technologies’ data breach was reported separately by each affected client and is understood to have affected more than 1 million individuals. It is currently unclear how many AEC patients have been affected, as the incident has not yet appeared on the HHS’ Office for Civil Rights breach portal.

The post Associated Eye Care Partners Issues Notifications About December 2020 Data Breach appeared first on HIPAA Journal.

Phoenixville Hospital Fires Employee for HIPAA Violation

Phoenixville Hospital in Pennsylvania has recently fired an employee for accessing the medical records of patients without authorization. According to the hospital operator, Tower Health, the unauthorized access was discovered during a routine audit of medical record access logs.

An employee was discovered to have accessed the medical records of several patients without authorization between October 2021 and May 2022, when there was no legitimate work reason for viewing those records. When the privacy violation was discovered, the employee was immediately suspended pending an internal investigation and was later fired for the HIPAA breach.

The employee viewed names, addresses, dates of birth, appointment dates, diagnoses, vital sign information, medications, test results, and physicians’ notes. Some of the accessed records included partial Social Security numbers and health insurance information. Tower Health said additional training has been provided to the workforce regarding patient privacy and the accessing of medical records.

Family Practice Center Reports October 2021 Hacking Incident

Family Practice Center in Pennsylvania has recently started sending notification letters to patients whose protected health information was exposed in an October 2021 cyberattack. According to the substitute breach notice on its website, an attempt was made to shut down its computer systems on October 11.

An investigation was launched and on May 21, 2022 – 7 months after the discovery of the attack – it was determined that some of the files accessed in the incident included patient data such as names, addresses, medical insurance information, and health and treatment information. Patient medical records were not involved. Notification letters were sent to affected individuals on July 5, 2022. Family Practice Center said it is unaware of any misuse of patient information.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

Southwest Health Center Suffers Cyberattack

The Platteville, WI-based non-profit community healthcare provider, Southwest Health Center, has recently started notifying patients about a cyberattack that was first discovered on January 11, 2022. A forensic investigation determined that an unauthorized third party accessed files containing the personal and protected health information of current and former employees, their dependents, and patients who received healthcare services at Southwest Health.

The information compromised in the breach included names, dates of birth, Social Security numbers, driver’s license or state identification card numbers, financial account numbers, medical information, and/or health insurance information. Complimentary credit monitoring and identity theft protection services have been offered to affected individuals.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Patient Information Compromised at Phoenixville Hospital, Family Practice Center, and Southwest Health Center appeared first on HIPAA Journal.

Roanoke, VA-based Benefit Plan Administrators Inc., has recently notified 3,775 individuals that an unauthorized individual gained access to its network and removed files that contained some of their protected health information. It is unclear from the breach notification letters when the incident occurred, but the forensic investigation concluded on March 15, 2022, and the notification letters were sent to affected individuals on or around June 15.

Benefit Plan Administrators said the following types of information were in the files that were removed from its systems: full names, addresses, dates of birth, Social Security numbers, gender classification, claims information, medications information, and medical diagnosis/conditions information. The breach was reported to the HHS’ Office for Civil Rights as four separate incidents. Employees of Alpha Natural Resources Non-Union VEBA Trust and Williamson Employment Services, Inc. are known to have been affected.

No evidence was found to indicate any of the removed information has been misused. Complimentary credit monitoring services have been provided to affected individuals. Benefit Plan Administrators said additional safeguards have been implemented by the IT department to prevent similar incidents in the future.

The People Concern Reports Breach of Employee Email Accounts

The People Concern, a Los Angeles, CA-based homeless service, has discovered the email accounts of some of its employees have been accessed by an unauthorized third party. The accounts contained the sensitive information of community members such as date of birth, Social Security number, health insurance information, and medical information regarding care received through its programs.

The security breach was detected when suspicious activity was observed in the email accounts, with the investigation revealing they had been accessed by unauthorized individuals at various times between April 6, 2021, and December 9, 2021

In response to the breach, email security measures have been enhanced and affected individuals have been offered complimentary memberships to an identity theft protection and resolution service for one year. It is currently unclear how many individuals have been affected.

Advocates Inc. Discovers Further Individuals Affected by 2021 Data Breach

In January 2022, Framingham, MA-based Advocates Inc. started notifying individuals affected by a cyberattack that saw its network compromised between September 14, 2021, and September 18, 2021. The incident was initially thought to have affected 68,236 individuals, but the investigation later confirmed that additional individuals had been affected. The review of the impacted files continued until June 9, 2022, and additional notifications were mailed to affected individuals on June 28, 2022. Details of the breach can be found in this post. It is currently unclear how many additional individuals have been affected.

The post Security Breaches Reported by Benefit Plan Administrators and The People Concern appeared first on HIPAA Journal.

A lengthy privacy violation has been detected by Virginia Commonwealth University Health System (VCU Health) that potentially started on January 4, 2006. According to the substitute breach notification on the VCU Health website, transplant donor information had been included in the medical records of certain transplant recipients, and transplant recipient information had also been included in the medical records of transplant donors.

When donors, recipients of transplants, or their representatives logged into the patient portal to view their medical records, they would have been able to view information about the donor/recipient. It is also possible that the information was provided to individuals who exercised their right under HIPAA to obtain a copy of their health information. In each case, the exposed information was not accessible to the public, only to specific transplant donors and recipients.

The privacy issue was detected by VCU Health on February 7, 2022, with the subsequent investigation confirming that additional information may also have been viewable, which included names, Social Security numbers, lab results, medical record numbers, date(s) of service, and/or dates of birth.

Affected individuals have been notified by mail and have been offered complimentary credit monitoring services if their Social Security numbers had been exposed. Steps have also been taken to improve privacy protections and prevent similar incidents in the future. VCH Health said, in total, 4,441 transplant donors and recipients had been affected.

Cheyenne Regional Medical Center Discovers Employee Snooped on Patient Records for 2 Years

Cheyenne Regional Medical Center (CRMC) has discovered a former employee had been accessing the medical records of patients without authorization for almost two years. The former employee had been provided with access to patient data to complete her work duties but had been accessing the records of patients for reasons unrelated to her role.

The privacy violation came to light when a former co-worker reported the individual for the HIPAA violation after a transfer to a different department within the medical center. The incident was investigated internally and it was confirmed that the records of up to 1,600 patients had been viewed without authorization between Aug. 31, 2020, and May 26, 2022.

CRMC compliance director, Gladys Ayokosok, said no evidence was found to suggest any patient information was copied or further disclosed by the former employee, and affected individuals have now been notified about the employee’s HIPAA violation. The types of information that may have been viewed included names, dates of birth, social security numbers, dates of care, medical record numbers, diagnoses, and treatments.

According to Ayokosok, the access went undetected for so long as the former employee had previously worked with the electronic health record provider. To detect any cases of snooping in the future, the IT department has created an audit trail, which will allow the IT team to tell if employees access records an unusual number of times, see why employees are accessing patient records, and check to make sure there is a legitimate reason for accessing patient data.

The post Patient Privacy Violated in Incidents at VCU Health and Cheyenne Regional Medical Center appeared first on HIPAA Journal.