HIPAA Compliance
Mid-Year HIPAA Enforcement Update
The HHS’ Office for Civil Rights has imposed 8 financial penalties on HIPAA-covered entities and business associates in the first 6 months of 2021 to resolve investigations into noncompliance with the Health Insurance Portability and Accountability Act Rules. In the first 6 months of 2020, only 1 financial penalty was imposed; however, OCR ended the year with 19 financial penalties imposed. This year, OCR has continued with its drive...
HIPAA Violation Results in Former Scripps Health Worker Being Charged for COVID-19 Unemployment Benefit Fraud
In a case being heard in San Diego, former Scripps Health employee Matthew Lombardo has been charged with felony HIPAA violations for obtaining and disclosing the protected health information of patients to his alleged co-conspirators. This is part of a Department of Justice investigation where nine San Diego residents have been charged in two separate indictments in connection with the theft of patients’ protected information and the...
US Court of Appeals Ruling Suggests Legal Action Possible for Privacy Breaches Under 14th Amendment
A ruling by the U.S. Court of Appeals for the Fourth Circuit suggests individuals whose privacy has been violated could potentially take legal action under the 14th amendment, but has confirmed that there is no private cause of action under the Health Insurance Portability and Accountability Act (HIPAA) when an individual’s privacy is violated as a result of an improper disclosure of their protected health information. The case...
HIPAA Right of Access Case Settled for $5,000 by Diabetes, Endocrinology & Lipidology Center
According to the HHS’ Office for Civil Rights (OCR), a settlement agreement has been negotiated with The Diabetes, Endocrinology & Lipidology Center, Inc. (DELC) in relation to a possible HIPAA Right of Access breach. DELC is a West Virginia-based healthcare supplier that focuses on treating endocrine disorders. In August 2019, a complaint was submitted to OCR which claimed that DELC had breached HIPAA when it didn’t respond...
HIPAA Security Rule Violations Lead to $25,000 Settlement between Clinical Laboratory & OCR
The Department of Health and Human Services’ Office for Civil Rights (OCR) says a $25,000 HIPAA settlement has been agreed with Peachstate Health Management, LLC, dba AEON Clinical Laboratories, that resolves a HIPAA case involving several HIPAA Security Rule violations. CLIA-certified laboratory, Peachstate, supplies a variety of different services to HIPAA-covered entities, including clinical and genetic testing services through its...
HIPAA Right of Access Case Involving Massachusetts Mental Health Clinic Settled for $65,000
Following a HIPAA Right of Action investigation by the HHS’ Office for Civil Rights (OCR), Arbour Hospital, a mental health clinic in Boston, MA, has agreed to pay a $65,000 HIPAA fine. OCR was made aware of a possible breach of the HIPAA Right of Access on July 5, 2019. A patient of Arbour Hospital claimed he had asked for a copy of his medical records from the hospital on May 7, 2019 but had not been given with those records inside...
Six-month Prison Term for Whistleblower Who Falsely Claimed Nurse Violated HIPAA
A six-month prison-term and $1,200 fine has been handed down to a Georgia man who falsely claimed a former acquaintance had violated patient privacy and breached the HIPAA compliance rules. Jeffrey Parker, 44, of Rincon, GA, claimed to be a HIPAA whistleblower in October 2019 and reported it HIPAA violations by an employee to the authorities. He claimed that there had been significant privacy breaches by a nurse at a Savannah, GA...
U.S. Healthcare Data Breach Report for January 2021
January witnessed a 48% month-over-month drop in the number of large healthcare data breaches, down from 62 breach incidents in December to 32 in January, according to an analysis by HIPAA Journal. While this is well beneath the 38 data breaches that are reported on average each month, it is still more than 1 data breach every day. There would have been a major drop in the amount of breached records were it not for a major data breach...
Ransomware Fact Sheet Issued by the National Cyber Investigative Joint Task Force
The National Cyber Investigative Joint Task Force (NCIJTF) has published a ransomware factsheet in order to increase awareness of the threat of ransomware attacks and provide more information which can be used to address and prevent ransomware attacks. The fact sheet was created by an interagency group of over fifteen government bodies and is primarily intended to be implemented by police and fire departments, state, local, tribal and...
Blackbaud Ransomware Attack Leads to Rady Children’s Hospital Class Action Lawsuit
In May 2020, the cloud software group Blackbaud was targeted and attacked with ransomware. As is typical in human managed ransomware attacks, data was stolen before file encryption took place. A portion of the stolen data included the fundraising databases of its healthcare customers. One of the impacted healthcare clients was Rady Children’s Hospital-San Diego, the biggest children’s hospital in California. A class action lawsuit has...
More Stringent Application of HIPAA Right of Access Rules by OCR Results in $200,000 Penalty
There is further evidence of the increasingly stringent application of the HIPAA Right of Access Rules by the HHS’ Office for Civil Rights (OCR) on healthcare providers that are not providing patients with timely access to their medical records following the announcement that a settlement had been reached with Banner Health to bring a HIPAA Right of Access investigation to a conclusion for $200,000. Under the HIPAA Privacy Rule...
OCR Confirms HIPAA Rules on Disclosures of PHI to Health Information Exchanges
The Department of Health and Human Services’ Office for Civil Rights has published guidance on the Health Insurance Portability and Accountability Act (HIPAA) Rules related to disclosures of protected health information (PHI) to health information exchanges (HIEs) for the public health activities of a public health authority (PHA). HIEs are organizations that facilitate the sharing of electronic PHI (ePHI) between more than two...
Researchers Find More than 45 Million Medical Images Stored on Unprotected Servers
More than 45 million medical images are currently exposed on unprotected servers and can be accessed freely over the internet without usernames or passwords. The medical images include metadata that includes personal and protected health information, which could be used for a variety of nefarious purposes. The unprotected images, which include MRIs, CT scans, and X-Rays were found by researchers at the CyberAngel Analyst Team, who...
Bill Passed by House Calling for HHS to Recognize Implementation of Cybersecurity Best Practices
The House Energy and Commerce Committee has passed a new bill (HR 7898) which seeks to amend the HITECH Act to require the Department of Health and Human Services to recognize whether cybersecurity best practices have been implemented by HIPAA-covered groups and business associates when making specific determinations, such as fines following security breaches or for other regulatory aims. The HIPAA Safe Harbor Bill, if passed into...
University of Cincinnati Medical Center HIPAA Right of Access Failure Results in $65,000 Fine
The 18th HIPAA financial penalty of 2020, the 12th fine under its HIPAA Right of Access enforcement initiative, has been revealed by HHS’ Office for Civil Rights. The most recent HIPAA compliance fine of $65,000 was sanctioned against the University of Cincinnati Medical Center, LLC (UCMC) and grew out of a complaint submitted by OCR on May 30, 2019 from a patient who had issued a request to UCMC on February 22, 2019 seeking an...
10th HIPAA Fine Under Right of Access Initiative Revealed by Office for Civil Rights
The 10th financial penalty under its HIPAA Right of Access enforcement initiative has been revealed by the U.S. Department of Health and Human Services’ Office for Civil Rights. California-based Riverside Psychiatric Medical Group has committed to paying a financial penalty of $25,000 to settle a possible HIPAA Right of Access breach and will implement a corrective action plan to see to it that compliance with this provision of the...
Three Data Breaches Result in $1m HIPAA Penalty for Aetna
Aetna Life Insurance Company and the affiliated covered entity (Aetna) have settled a HIPAA compliance violation case with the Department of Health and Human Services’ Office for Civil Rights (OCR) and has agreed to pay a financial penalty of $1 million. OCR investigated Aetna after receiving three breach reports in 6 months in 2017 from the health insurer. The initial data breach was made known to OCR in June 2017 and was due to the...
OCR HIPAA Right of Access Initiative Results in 9th Financial Penalty
The HHS’ Office for Civil Rights (OCR) is maintaining the pace in its crackdown on healthcare groups that are 1005 adhering to the HIPAA right of access. Recently, OCR revealed that it is sanctioning its ninth enforcement action against a HIPAA-covered group in relation to the failure to provide patients with timely access to their medical records at a reasonable price. HIPAA allocates patients permission to view or receive a copy of...
MHealth App Developers and Cloud Services Providers New Resources made Available by OCR
New resources for mobile health app developers have been made available by the Department of Health and Human Services’ Office for Civil Rights (OCR). This comes with a planned update and rebranding of its Health App Developer Portal. The portal – Resources for Mobile Health Apps Developers – supplies information for mobile health app developers on the HIPAA Privacy, Security, and Breach Notification Rules and how they are relevant...
Citrix Endpoint Management/XenMobile Server Patches Released
Patches have been released to address two critical vulnerabilities in Citrix Endpoint Management (CEM) / XenMobile Server. The flaws could be exploited by an unauthenticated individual to access domain account credentials, take complete management of a XenMobile Server, and view VPN, email, and web applications and obtain sensitive corporate information. One of the flaws was discovered by Andrey Medov of Positive Technologies, who...
Ban on HHS Funding a National Patient Identifier System Removed by House of Representatives
The House of Representatives has voted to remove the ban on the Department of Health and Human Services using federal funds to create a national patient identifier system. The Health Insurance Portability and Accountability Act (HIPAA) mandated the creation of a national patient identifier system. As the name indicates, a national patient identifier system would see each person in the United States issued with a permanent, unique...
Rhode Island Health System Hit with $1 Million Fine for Noncompliance with HIPAA Rules
The Rhode Island non-profit health system, Lifespan Health System Affiliated Covered Entity (Lifespan), has been fined $1,040,000 by the Department of Health and Human Services’ Office for Civil Rights for violations of the Health Insurance Portability and Accountability Act (HIPAA) Rules. Had HIPAA Rules been followed, a data breach of 20,431 healthcare records would have been avoided. Lifespan was investigated by OCR following the...
Lack of Encryption & Other HIPAA Breaches Leads to $1m HIPAA Penalty for Lifespan
The HHS’ Office for Civil Rights has sanctioned a $1,040,000 HIPAA penalty on Lifespan Health System Affiliated Covered Entity (Lifespan ACE)after identifying systemic noncompliance with the HIPAA Rules. Lifespan is a not-for-profit health system located in Rhode Island that has many healthcare provider affiliates in the state. On April 21, 2017, a breach report was submitted with OCR by Lifespan Corporation, the parent company and...
Philips Ultrasound Systems Vulnerability Discovered
An authentication bypass vulnerability affecting Philips Ultrasound Systems that could targeted by a hacker to view or modify data has been discovered. The flaw is caused by the presence of an alternative path or channel that can be implemented to bypass authentication controls.The flaw is tracked as CVE-2020-14477. This is a low severity flaw which has been assigned a CVSS v3 base score of 3.6 out of 10. To target the vulnerability,...
Information on Contacting COVID-19 Patients to Request Blood & Plasma Donations
Once patients contract an infectious respiratory disease like COVID-19, the immune system creates antibodies that supply protection if the pathogen appears again. The antibodies in the blood of patients who recover from an illness like this are key to fighting it. Those antibodies could also be used to treat other patients. Through the donation of blood and plasma two preparations can be created: Convalescent plasma and hyperimmune...
Improved Compliance Revealed in Ciitizen HIPAA Right of Access Study
There has been a major improvement in compliance with the HIPAA Right of Access, according to the most recent Patient Record Scorecard Report from Ciitizen. To formulate the report, Ciitizen conducted a study of 820 healthcare suppliers to assess how well each responded to patient requests for copies of their healthcare data. A wide variety of healthcare suppliers were assessed for the study, from single physician practices to large,...
HIPAA Violations in Michigan and Illinois Lead to Healthcare Workers Being Fired
A staff member at Ann & Robert H. Lurie Children’s Hospital of Chicago has been fired accessing the medical records of patients without the appropriate authorization over a period of 15 months. The privacy violations were discovered when, after reviewing access logs, the hospital found that a staff member had viewed the medical records of 4,824 patients without authorization between November 2018 and February 2020. The range of...
Three Actively Exploited Flaws Patched by Microsoft
On April 2020 Patch Tuesday, Microsoft made available updates to fix 113 flaws in its operating systems and software solutions, 19 of which have been rated critical. This month’s group of updates includes fixes for 3 zero-day flaws that are being actively exploited in real world attacks.Two of the actively exploited flaws were revealed by Microsoft in March and Microsoft suggested workarounds to limit the chance of exploitation. The...
Waiver of HIPAA Penalties for Good Faith Operation of COVID-19 Community-Based Testing Sites
The HHS has issued an additional Notice of Enforcement Discretion covering healthcare providers and business associates that manage some aspect of COVID-19 community-based testing sites. Under the terms of the Notice of Enforcement discretion, the HHS will not issue sanctions and penalties in relation to good faith participation in the operation of COVID-19 community-based testing sites. The Notice of Enforcement discretion is...
PHI Disclosures for Public Health and Health Oversight Activities Allowed in Notice of Enforcement Discretion for Business Associates
On April 2, 2020, the Department of Health and Human Services revealed that with immediate effect, it will be applying enforcement discretion and will not impose sanctions or fines against healthcare providers or their business associates for good faith uses and sharing of protected health information (PHI) by business associates for public health and health oversight activities for the duration of the COVID-19 public health...
Coronavirus Pandemic Guidance on Telehealth & HIPAA Released by OCR
After the announcement made by the HHS’ Office for Civil Rights that enforcement of HIPAA compliance linked to the good faith provision of telehealth services for the duration of the COVID-19 pandemic has been relaxed, OCR has published guidance on telehealth and remote communications. Telehealth is defined by the HHS’ Health Resources and Services Administration (HRSA) as “the use of electronic information and telecommunications...
Google’s Response to Senators Questions About Ascension Partnership Deemed Incomplete
After it became public that a massive amount of patient data had been shared with Google by the Catholic health system Ascension, the second biggest health system in the United States, a bipartisan group of Senators – Sen. Bill Cassidy, M.D., (R-LA), Elizabeth Warren (D-MA), and Richard Blumenthal (D-CT) – wrote to Google asking for answers about the nature of the agreement and the data the company received. Ascension manages 150...
Manchester Ophthalmology & UnitedHealthcare Impacted by Data Breaches
Manchester Ophthalmology in Connecticut has suffered a cyberattack in which the hackers may have gained access to patient data. The eye care supplier became aware of the cyberattack on November 25, 2019 when employees identified suspicious activity on the network. Assisted by an external technology firm, it was determined later that day that hackers had gained access to its systems and tried to deploy ransomware. Access was first...
2020 Healthcare Data Breach Report
Protenus has released its 2020 healthcare data breach report which shows the past 12 months have been the worst ever in terms of the number of reported breaches. For its 2020 Breach Barometer report, Protenus, in conjunction with databreaches.net, identified more than 572 healthcare data breaches of 500 or more records in 2019, up 48.6% compared to 2018. The number of data breaches affecting the healthcare industry has increased...
Partially Completed Prescriptions of Schedule II Drugs Must be Tracked: HHS
The Department of Health and Human Services has released a final rule changing the HIPAA National Council for Prescription Drug Programs (NCPDP) D.0 Telecommunication Standard that obligates pharmacies to record partially completed prescriptions for Schedule II drugs. The modification is part of HHS efforts to manage opioid abuse in the United States and will supply a greater quantum of data that may help control impermissible refills...
Novel Coronavirus Outbreak Prompts HHS Covered Entity HIPAA Data Sharing Warning
In response to the 2019 Novel Coronavirus outbreak, the Department of Health and Human Services has released a bulletin to make HIPAA-covered entities aware of the allowable methods for sharing patient information during outbreaks of infectious disease and other emergency situations, In the news release, the HHS confirmed that at such times, the protections of the HIPAA Privacy Rule still apply and healthcare organizations must...
Survey: Cost of Healthcare Data Breaches Predicted to Reach $4 Billion in 2020
Healthcare sector data breaches are taking place at an unprecedented level. The healthcare data breach figures for 2019 have yet to be drawn up, but so far 494 data breaches of more than 500 records have been made known to the HHS’ Office for Civil Rights and more than 41.11 million records were exposed, stolen, or impermissibly disclosed in 2019. That makes 2019 the worst year on record for healthcare data breaches and the second...
2019 HIPAA Enforcement
2019 was another period with stringent HIPAA compliance enforcement evident. Action taken by the Department of Health and Human Services’ Office for Civil Right (OCR) lead to has resulted in 10 financial penalties. $12,274,000 has been paid to OCR in 2019 to resolve HIPAA violation cases. 2019 witnessed two civil monetary penalties sanctioned and settlements were agreed with eight groups, one less than 2018. In 2019, the average fine...
Rep. Jayapal Questions Google & Alphabet Ascension Partnership
Rep. Pramila Jayapal (D-Washington), a member of the House Judiciary Subcommittee on Antitrust, Commercial, and Administrative Law, has written to Google and Alphabet in relation to their Ascension partnership. She has demanded answers to several questions about how protected health information has been obtained, the measures put in place to protect patient data, and how Google will be using the PHI. The partnership between Google and...
HIPAA Compliance for Amazon Lex
Amazon has revealed that the Amazon Lex chatbot service now supports HIPAA compliance and can be used by healthcare groups without breaching Health Insurance Portability and Accountability Act Rules. Amazon Lex is a service that permits customers to create conversational interfaces into applications using text and voice. It permits the creation of chatbots that use lifelike, natural language to engage with clients, submit questions,...
Privacy Protections for Consumer Health Data to be Enhanced by Smartwatch Data Act
Sens. Bill Cassidy, M.D., (R-Louisiana) and Jacky Rosen, (D-Nevada) have introduced the Stop Marketing And Revealing The Wearables And Trackers Consumer Health (Smartwatch) Data Act. This new legislation will ensure that health data gathered through fitness trackers, smartwatches, and health apps cannot be sold or shared without consumer consent. The Health Insurance Portability and Accountability Act (HIPAA) applies to health data...
Sentara Hospitals Agrees to $2.175M HIPAA Settlement for Breach Notification Rule and BAA Failures
The Department of Health and Human Services’ Office for Civil Rights (OCR) has issued its eighth HIPAA financial penalty of 2019. Sentara Hospitals has agreed to settle possible breaches of the HIPAA Privacy and Breach Notification Rules and will pay a penalty of $2.175 million and will adopt a corrective action plan to remedy areas of noncompliance. Sentara runs 12 acute care hospitals in Virginia and North Carolina and has more than...
Timothy Noonan Revealed as New Deputy Director for Health Information Privacy at Office for Civil Rights
The Department of Health and Human Services’ Office for Civil Rights (OCR) has appointed Timothy Noonan Deputy Director for Health Information Privacy. The position of the Deputy Director for Health Information Privacy is to lead the Health Information Privacy Division of the Office for Civil Rights, oversee OCR’s national health information privacy policy and outreach activities, and administer and police the HIPAA Privacy, Security,...
Range of HIPAA Breaches Result in $2.15 Million Civil Monetary Penalty for Jackson Health System
The Department of Health and Human Services’ Office for Civil Rights has sanctioned a $2.15 million civil monetary penalty against the Miami, FL-located nonprofit academic medical system, Jackson Health System (JHS), for a slew of breaches of HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. In July 2015, OCR became aware of many media reports in which the PHI of a patient was impermissibly shared. The person was a...
PHI Disclosures on Yelp Lead to $10,000 Fine for Dental Practice
The Department of Health and Human Services’ Office for Civil Rights has agreed to a HIPAA settlement for a violation case with Elite Dental Associates in relation to the impermissible disclosure of a number of patients’ protected health information (PHI) when answering patient reviews on the Yelp review website. Elite Dental Associates is a Dallas, TX-based privately-owned dental clinic that provides general, implant and cosmetic...
National Patient Identifier Repeal Act Introduced by Senator Rand Paul
Sen. Rand Paul, M.D., (R-Kentucky) has brought in a new bill that aims to have the national patient identifier provision of HIPAA permanently deleted due to privacy concerns over the configuration of such a system. At present, HIPAA is best known for its healthcare data privacy and security regulations, but the national patient identifier system was proposed in the first HIPAA legislation of 1996 as a measure to facilitate data...
Flaws Discovered in WLAN Firmware Used by Philips IntelliVue Portable Patient Monitors
Two flaws have been discovered in Philips IntelliVue WLAN firmware which impact certain IntelliVue MP monitors. The flaws could be exploited by hackers to download malicious firmware which could affect data flow and lead to an inoperable condition warning at the device and Central Station. Philips was made aware of the flaws by security expert Shawn Loveric of Finite State, Inc. and proactively released a security advisory to allow...
NCCoE Releases Mobile Device Security Guidance for Corporate-Owned Personally Enabled Devices
The National Cybersecurity Center of Excellence (NCCoE) has published new draft NIST mobile device security guidance to help groups address the risks created by corporate-owned personally enabled (COPE) devices. Mobile devices permit staff members to access resources vital for their work duties, no matter where those individuals are based. As such, the devices allow groups to enhance efficiency and productivity, but the devices bring...
Unsecured Online PACS Makes 400 Million Medical Images Freely Accessible
Following a recently completed investigation by ProPublica, the German public broadcaster Bayerischer Rundfunk, and vulnerability and analysis company, Greenbone Networks has stated that 24.3 million medical images included in image storage systems are freely accessible on the Internet and require no authentication to view or install the images. Those images, which include X-rays, MRI, and CT scans, are held in picture archiving and...
Kaspersky Lab Survey: No Cybersecurity Training for 32% of Healthcare Workers
There have been a minimum of 200 breaches of greater than 500 records reported since January and 2019 looks set to be another record-breaking 12 months for healthcare data breaches. The ongoing rise in data breaches lead to Kaspersky Lab completing a survey to ascertain more about the state of cybersecurity in healthcare. Kaspersky Lab has now released the second part of its report from the survey of 1,758 healthcare workers in the...
HIPAA Compliance & iCloud
We look at HIPAA compliance and iCloud because, as more and more businesses take advantage of cloud computing, an important question for Covered Entities to consider is, are cloud storage services such as iCloud HIPAA compliant? If so, Apple´s cloud storage products – iCloud and iCloud+ – could be a convenient and user-friendly option for storing and saving electronic PHI (ePHI). Apple´s iCloud and iCloud+ services are available...
Emergency Notifications Systems & Business HIPAA-Compliance
Emergency notification systems for business are software services that are often implemented to alert personnel to the risk of danger. Situation that they are used include incoming hurricanes, chemical spills, active shooter events, and fires; and therefore it would be unusual rare for Protected Health information (PHI) to be shared in the context of an emergency alert. In addition, outside of the healthcare and healthcare insurance...
Amazon CloudFront & HIPAA Compliance
Amazon CloudFront is a web service that enables users to optimize the speed of their web content delivery via the Internet and for website hosting. Normally, when a website is viewed, the visitor experiences some latency loading static and dynamic content. The reason for this is viewers will not make a direct connection to the content, instead they will be directed through a path to reach the server where the content can be seen. The...
One-Year Prison Sentence for TermPatient Care Coordinator Following HIPAA Violation
A former patient care coordinator based at University of Pittsburgh Medical Center (UPMC) has been given a one-year prisons sentence for accessing the medical records of patients and using that information to cause malicious damage. Sue Kalina, 62, of Butler, PA, had previously been employed at UPMC Tri Rivers Musculoskeletal and Allegheny Health Network as a patient care coordinator. On March 30, 2016, while a staff member with UPMC,...
HIPAA Compliance & IBM Cloud
IBM provides a cloud platform to help groups create their mobile and web services, build native cloud apps, and host their infrastructure along with a wide variety of cloud-based services for the capture, analysis, and processing of data. The platform has already been configured by many healthcare suppliers, payers, and health plans, and applications and portals have been developed to provide patients with better access to their...
Phishing Attack Impacts PHI of 10,893 Summa Health Patients
It was discovered on on May 1 that up to four employee email accounts containing patients’ protected health information (PHI) have been infiltrated at Akron, Ohio-based Summa Health after an an unauthorized person obtained access. Summa Health noticed the breach and launched an investigation that found two email accounts were infiltrated during August 2018, and a further two accounts between March 11, 2019 and March 29, 2019. All...
HIPAA Enforcement Safe Harbor Called for in HELP Committee Bill
There may be some implications for HIPAA-covered entities after the Senate Health, Education, Labor and Pensions (HELP) Committee approved the Lower Health Care Costs (LHCC) Act of 2019. One of the main targets of the bill is to enhance the transparency of healthcare expenses and service quality. The bill aims to bring a finish to surprise health bills and make sure patients are kept updated about healthcare costs. The LHCC Act...
Allowable Uses and Disclosures of PHI for Care Coordination and Continuity of Care Clarified by OCR
The Department of Health and Human Services’ Office for Civil Rights has released new HIPAA guidance for health plans on how protected health information can be sent to support care coordination and continuity of care. The new material, which has been published in an FAQ format, addresses two questions commonly asked by health plans: Can PHI be shared with another health plan for care coordination reasons? OCR has said that the HIPAA...
Sensitive Information of 11.9 Million Quest Diagnostics Patients Compromised
Quest Diagnostics, one of the leading medical laboratories and blood testing companies in the United States, has been affected by a data breach at one of its vendors. That breach has resulted in the exposure and potential theft of almost 12 million individuals’ personal, medical, and financial information. According to a recent U.S. Securities and Exchange Commission (SEC) filing, Quest Diagnostics was notified of a data breach at the...
Medical Informatics Engineering Settles HIPAA Violation Cases for $1 Million
The electronic medical record software company Medical Informatics Engineering (MIE) has agreed to settle its HIPAA compliance violation case with the U.S. Department of Health and Human Services’ Office for Civil Rights for $100,000 and has agreed to pay $900,000 to resolve a multi-state action filed by state attorneys general over a 2015 data breach. MIE experienced a data breach on May 7, 2015 when hackers gained access to a server...
Healthcare Data Breach Report for April 2019
April 2019 was the worst month recorded, to date, for healthcare data breaches. More data breaches were made known to the Department of Health and Human Services’ Office for Civil Rights (OCR) during April than other other month since healthcare data breach reports were first reported in October 2009. In April, 46 healthcare data breaches were made known to OCR, which is a 48% increase from March and 67% higher than the average number...
Legal Action: Court Told Hospital Worker Shared Patient Information
A legal action has been submitted against Atchison Hospital in Kansas by a rape victim who claims an x-ray technician at the hospital got in touch with her attacker and disclosed sensitive data about the treatment she received at the hospital. According to a report in the Kansas City Star, after being raped, the woman sought treatment at the hospital. She was given a rape kit examination, and allegedly made it clear to the hospital...
Bodybuilding.com Data Breach Impacts 3,193 Employees
The bodybuilding and personal fitness website Bodybuilding.com has revealed it has had to deal with a security incident that may have lead to the information of customers and employees being accessed by unauthorized people. While the breach affecting customers was not a reportable incident under HIPAA, HIPAA does cover group health plans. As such, bodybuilding.com was required to report the breach of group members’ PHI to the Office...
Delayed Breach Response Costs Tennessee Medical Imaging Firm $3 Million
It is not possible to prevent all healthcare data breaches, but when a breach is experienced it must be investigated and mitigated promptly. Delaying the breach response and notifications can prove extremely costly, as the Tennessee medical imaging firm Touchstone Medical imaging discovered. On May 9, 2014, Touchstone Medical Imaging was notified by the FBI that an FTP server had been left unsecured. At the same time, the HHS’ Office...
Court Rules that Negligence Claim Based on HIPAA Violation can Proceed in Arizona
An Arizona man who submitted a legal action against Costco in relation to a privacy violation and had the lawsuit thrown out by the trial court has had the decision overturned by the Court of Appeals, which ruled that the patient can sue the pharmacy for negligence in relation to a violation of the Health Insurance Portability and Accountability Act (HIPAA). The privacy violation in question took place in 2016. The man had was sent a...
HHS Reforms HITECH Act Penalties for HIPAA Breaches
The Department of Health and Human Services has published a notification of enforcement discretion in relation to the civil monetary penalties that are applied when breaches of HIPAA compliance rules are identified and will be bringing down reducing the maximum financial penalty for three of the four penalty levels. The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 raised the penalties for HIPAA...
Can SparkPost be Deemed HIPAA Compliant?
SparkPost is a widely-used email delivery and analytics platform that is implemented by many enterprises to send information to customers Healthcare bodies are required to adhere with HIPAA Rules, so to determine is SparkPost supports HIPAA compliance and whether its platform can be used in a HIPAA compliant manner we have considered the following. SparkPost is the largest global email delivery and analytics platform and is used to...
Proposal to Pay Patients to Share Their Healthcare Data Included in Oregon Health Information Property Act
The Oregon Health Information Property Act proposes that healthcare patients should be permitted to legally authorize their healthcare suppliers to sell their health data and for them to paid if their health information is sold to a third party. At present, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule restricts the allowable uses and disclosures of ‘Protected Health Information.’ HIPAA-covered bodies...
$3m HIPAA Settlement Agreed Between Cottage Health and OCR
A HIPAA penalty settlement of $3,000,000 has been agreed between the Department of Health and Human Services’ Office for Civil Rights (OCRand the Santa Barbara, CA-based healthcare provider Cottage Health in relation to a HIPAA compliance breach. Cottage Health runs four different hospitals in California, including Santa Barbara Cottage Hospital, Santa Ynez Cottage Hospital, Goleta Valley Cottage Hospital and Cottage Rehabilitation...
Industry-Wide Effort to Accelerate Interoperability Urged by Hospital Associations
Seven major hospital associations, including the American Hospital Association (AHA), are leading pleas for an industry-wide effort to enhance data sharing. The new report is seeking public and private stakeholder support to speed up interoperability and help remove the obstacles to data sharing. In order to achieve the full potential of the nation’s healthcare system, health data must flow without obstruction. Only then will it be...
Warning About DNS Hijacking Issued by DHS
The U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Agency (CISA) has released an emergency warning regarding DNS hijacking campaigns. All government agencies have been told to review their DNS settings over the next 10 days. CISA reports that cyber criminals have been targeting government agencies and changing their Domain Name System records. DNS records are used to determine the IP address of a website...
Criminal HIPAA Violation Leads to Probation for Physician
Following pleading guilty to a criminal violation of HIPAA Rules, a physician has received 6 months’ probation as an alternative to a jail term and financial penalty for the wrongful disclosure of patients’ PHI to a pharmaceutical company. The Department of Justice in Massachusetts heard the legal case in conjunction with a case against Massachusetts-based pharma firm Aegerion. In September 2017, the Novelion Therapeutics subsidiary...
Vulnerabilities Identified in LabKey Server Community Edition
Security specialists at Tenable Research have identified a number of flaws in LabKey Server Community Edition 18.2-60106.64 which could be targeted to obtain user credentials, access medical data, and run arbitrary code via the Labkey browser. LabKey Server is an open source collaboration tool that enables scientists to integrate, analyze, and distribute biomedical research data. While the platform acts as a secure data repository,...
Anthem Data Breach Settlement of $16 Million Agreed with OCR
The largest ever healthcare data breach in the United States has attracted the largest ever fine for noncompliance with HIPAA Rules. The Anthem data breach settlement of $16 million eclipses the previous highest HIPAA fine of $5.55 million and reflects not only the severity of the Anthem Inc data breach, which saw the protected health information of 78.8 million plan members stolen, but also the extent of noncompliance with HIPAA...
Failure to Encrypt ePHI Costs Cancer Treatment and Research Center $4.34 Million
The Department of Health and Human Services’ Office for Civil Rights has announced its third HIPAA financial penalty of 2018. The $4.34 million civil monetary penalty is the fourth largest HIPAA penalty ever issued to resolve HIPAA violations. While most covered entities and business associates agree to settle HIPAA violations and pay the penalty, on rare occasions the penalties are contested, and the case goes before an...
Cloud Tool Reduces AWS Costs by 60%
Healthcare groups are, increasingly, implementing cloud-based systems to meet their IT requirements, but while there are multiple reasons for moving applications, infrastructure and data center operations to the cloud, the high cloud costs make it an unattractive possibility. Many healthcare groups purchase AWS EC2 instances for to implement this on their servers. While this particular platform meets their requirements, the...
582,000 Patients Warned of Potential PHI Compromise by California Dept. of Developmental Services
A recent survey carried out with hackers, incident responders, and penetration testers has showed that most can gain access to a targeted system in around 15 hours, but 54% of hackers take under five hours to gain access to a system, and identify and obtain sensitive data. The data comes from the second yearly Nuix Black Report and its survey of 112 hackers and penetration testers, 79% of which were located in the United States. Those...
Manufacturer of Oxygen Equipment Reports Data Theft Incident Possibly Impacting 30,000 Individuals
Inogen, a manufacturer of portable oxygen concentrators, has found that an unauthorized individual has obtained the credentials of a employees and has used them to access to the staff member’s email account. Phishing and other credentials theft incidents are commonplace in the healthcare industry, although what makes this incident unusual is the number of people affected by the attack. The compromised email account includeed the...
Integrated Rehab Consultants Takes 16 Months to Notify Patients of PHI Breach
Illinoie-based physiatry organization Integrated Rehab Consultants is broadcasting notification correspondence to some patients alerting them to the exposure of some of their protected health information, in line with HIPAA regulations. However, the breach was not discovered within the past 60 days. Integrated Rehab Consultants (IRC) initially became aware of the exposure of PHI on December 2, 2016 – 16 months previously. The...
Des Moines Crisis Observation Center Discovers Inappropriate Dissemination of Patient Data
1,071 patients who were treated at the Des Moines Crisis Observation Center managed by Polk County Health Services Inc., have been contacted to advise them that some of their protected health information has been “accidentally and unknowingly disseminated” at some point in the last 3.5 years. The breach was first identified on February 14, 2018, although the inquiry revealed that information was first disclosed on June 1, 2014 and the...
Misconfigured Security Settings Results in63,500 Middletown Medical Patients Having PHI Exposed
A security setting that was not configured properly on a radiology system has lead to the patients’ protected health information of tens of thousands of patients of Middletown Medical, a multi-specialty physicians’ group based in Middleton, NY, The breach was first discovered on January 29, 2018. On January 30 the interface was realigned that any unauthorized individuals could no longer obtain patient information. The length of time...
Possible Abuse of Credit Card Details Affects 1,500 Baptist Health Patients
A former worker at Baptist Health’s West Kendall Baptist Hospital based in Miami, FL illegally obtained the credit card details of patients and used the information to complete fraudulent transactions. The misuse of credit cards was identified by Baptist Health on March 9, 2018 and the matter was then made known to Miami-Dade law enforcement and the employee was removed from their position. Baptist Health has not made it known...
Multiple Staff Email Accounts Accessed in UnityPoint Health Phishing Attack
It has been discovered that the email accounts of several employees of UnityPoint Health hhave been compromised and accessed by unauthorized people. Access to the staff email accounts was first obtained on November 1, 2017 and went on for a period of three months until February 7, 2018, when the phishing attack was noticed and access to the compromised email accounts was turned off. When the phishing attack was first noticed,...
Almost 14,000 Affected by SAMBA Privacy Breach
14,000 individuals are being alerted about a February 2018 breach of protected health information at the Special Agents Mutual Benefit Association (SAMBA). The data breach affects eligible family members of plan members who were covered by the Federal Employees Health Benefits Plan during 2017. It is an Internal Revenue Service (IRS) obligation for SAMBA to send a copy of Form 1095-B to all plan members every tax year. The form in...
Data Breach Notification and Information Security Laws Updated in Oregon
Data breach notification laws in Oregon have been updated to enhance security for state residents whose personal data is accessible to the public during a data breach. Kate Brown, the State governor, signed the Senate Bill (SB 1551) last month, which updates several parts of the legislation, particularly Oregon’s Breach Notification Law, O.R.S. 646A.604 and Information Security Law, O.R.S. 646A.622. The updates will become...
Arc of Erie County New York Reports 3,751 Patients’ PHI Was Exposed on Internet over 30-Month Period
A provider of person-centered services to individuals with developmental disabilities, The Arc of Erie County New York (The Arc), has reported that two spreadsheets listing the protected health information of 3,751 patients were open to the public via the Internet without the need for authentication for a time period of longer than 30 months from July 2015 to February 2018. The two spreadsheets in question could be seen through the...
Missing Hard Drives from Chesapeake Regional Healthcare Contained PHI of 2,100 Patients
Chesapeake, Virginia based Chesapeake Regional Healthcare has reported that two hard drives containing the protected health information (PHI) of approximately 2,100 patients are missing from their Chesapeake Regional Medical Center campus at that location. The private health information stored on the devices in question relates to patients who participated in research at its Sleep Center between April 2015 and February 2018. it is...
Improper Disposal of PHI is Common According to JAMA Study
A recently completed study (published in JAMA) has emphasized just how often hospitals are disposing of PHI in an unsafe fashion. While the study was completed in Canada, which is not subject to HIPAA, the results emphasize a critical area of PHI security that is often neglected. Incorrect Destruction of PHI is More Commonplace than Previously Thought Researchers at St. Michael’s Hospital in Toronto reviewed recycled paperwork at...
Data Breach Notification Law Enacted by South Dakota
It has taken some time for South Dakota to introduce legislation to enhance protections for consumers impacted by breaches of their personal private data. Laws have already been passed in 48 states that obligate persons and companies that hold personal information to publish notifications to breach victims when that information is accessible by unauthorized individuals. Last week, South Dakota citizens were given similar security...
Cambridge Health Alliance Advised of PHI Breach by Law Enforcement
Massachusetts based Cambridge Health Alliance (CHA) have been advised, by law enforcement agencies, that the protected health information of some of its clients has been found in the possession of an unauthorized person. The breach occurred On January 31, 2018, Everett Massachusetts Police Department made CHA aware that files including the PHI of some of its clients had been found in the possession of an person unauthorized to have...
Clinical Pathology Laboratories Southeast Patients’ Have PHI Exposed Due to Theft of Unencrypted Laptop
Clinical Pathology Laboratories Southeast, Inc., (CPLSE) has revealed that an unencrypted laptop computer issued to a member of staff has been stolen, exposing the protected health information of a number of patients and their payment guarantors. CPLSE quickly activated safety actions to prevent the laptop from being used to gain access to its network and the theft was made known to law enforcement; however, it is possible that the...
35,000 Patients of ATI Physical Therapy Affect by Data Breach
The protected health information of more than 35,000 patients of ATI Physical Therapy has has potentially been compromised by a cyber attack that occurred when hackers obtained access to staff email accounts. A security violation was discovered on January 18, 2018 when ATI Physical Therapy saw that the direct deposit information of some of its staff members had been altered in its payroll platform. Quick action was taken to remove...
Finger Lakes Health Computer System Grinds to Halt After Ransomware Attack
A ransomware attack on Finger Lakes Health, based in Geneva, NY, has impacted the computer system to the extent that staff have had to work using pen and paper. In the meantime efforts to remove the malware and restore access to electronic data have been enhanced. The health system came under attack from the health system beginning at around midnight on Sunday March 18, 2018, with workers first noticing the attack when a ransom demand...
NH-ISAC Partnership with Anomali Boosts Threat Detection and Data Sharing
The National Health Information Sharing and Analysis Center (NH-ISAC) and Anomali have begun working together and will be providing threat intelligence to healthcare centers through NH-ISAC. As part of this partnership Anomali will be helping NH-ISAC with the required tools and infrastructure to allow its clients to work together and share threat intelligence with other subscribers. Anomali will be making up to date threat...
1,049 Patients of RoxSan Pharmacy Notified of 2015 Email Breach
1,049 patients of Beverly Hills, CA-based RoxSan Pharmacy have been warned that some of their protected health information has been shared with a business associate through an unencrypted email. The notification letters were sent to affected people during February, although the incident happened on January 20, 2015. Commenting in a recent press release, RoxSan stated that affected individuals are being contatced in “as timely a manner...
Primary Health Care Experiences Multiple Email Hacks
A non-profit network of community health centers in Des Moines, Marshalltown and Ames, IA, Primary Health Care Inc. has reported that hackers gained access to the email accounts of four workers and may have viewed or downloaded patients’ PHI. A press release issued by Primary Health Care and published a substitute breach notice to its website on March 16, 2018 outlining that the breach occurred on February 28, 2017. The breach was...
10,000 ShopRite Clients Have PHI Exposed to Improper Destruction of Device
A Millville, New Jersey based ShopRite pharmacy has reported that an electronic device used to save the signatures of people has been destroyed without first deleting all stored protected health information from the device. A restricted amount of protected health information was held on the computing device, including patients’ names, birth dates, contact details, zip codes, prescription numbers, medication names, signatures,...
PHI of 5,300 Individuals Disclosed to Employees of QuadMed
The protected health information of 5,305 patients of QuadMed, a Wisconsin-based provider of medical, laboratory, pharmacy, fitness, and physical therapy services, may have been impermissibly shared with some employees. In November 2013, QuadMed took over management of an onsite clinic at Hillenbrand Inc. Occupational health information of employees based at the Batesville, IN-based manufacturer was held in an electronic medical...
33,420 BJC Healthcare Patients Have PHI Exposed in 8-Months HIPAA Breach
BJC Healthcare has revealed that the protected health information of 33,420 of it’s subscribers has been open to public accessible for eight months without adequate for HIPAA compliant authentication required to view the PHI. The BJC Healthcare group is one of the largest not-for profit healthcare groups located in the United States. The healthcare organization, based in St Louis, runs two nationally recognized hospitals in...
Top Healthcare Security Threats Revealed in HIMSS Survey Results
HIMSS has released the findings of its 2017 healthcare cybersecurity survey, which gives us valuable insights into the state of cybersecurity in the healthcare sector and names the top healthcare security threats. The HIMSS 2018 cybersecurity survey was carried out on 239 respondents from the healthcare sector between December 2017 and January 2018. The findings of the survey were revealed at the HIMSS 2018 Conference & Exhibition...