Why Healthcare Security Matters

guest · Oct 14, 2021

Williamsville School employees' private health data inadvertently leaked by Independent Health
October 8, 2021
https://www.wgrz.com/article/news/l...ealth/71-2d476804-2d70-4689-b7c9-d4fb224b54c6

Independent Health said Friday that the names, member ID numbers and medical information for over 500 Williamsville School District employees were accidentally released to stop loss carriers and brokers.

The inadvertent breach took place between August 2019 and August 2021 and was discovered during a regular safety and security review. It did not include Social Security numbers or any other personal financial information.

“The embedded data that inadvertently remained in the secure report was due to human error and Independent Health has already implemented the necessary safety steps to address this and prevent further occurrences." said Frank Sava, spokesperson for IH.
Independent Health believes it's extremely unlikely any of the released information was misused and the leak went to business partners who fully understand requirements to keep data secure and private.
Click to expand...

guest · Oct 22, 2021

Dental Alliance Reports Vendor Breach Affecting 170,000
Multiple Breach Reports for Phishing Incident Reflect Notification Complexities
October 21, 2021
https://www.databreachtoday.com/dental-alliance-reports-vendor-breach-affecting-170000-a-17775

The Professional Dental Alliance is notifying more than 170,000 individuals in about a dozen states of a phishing breach involving an affiliated vendor that provides nonclinical management services to dental practices owned by PDA.

New Castle, Pennsylvania-based PDA owns dental practices in 15 states, a PDA spokesman says.
In a statement, PDA says North American Dental Management, an affiliated vendor that provides administrative and technology support services for PDA practices, experienced an email phishing and credential harvesting attack on March 31 and April 1.
Click to expand...

The incident potentially exposed patient information including name, mailing address, email address, phone number, dental information, insurance information, Social Security number and financial account numbers, PDA says.

Additionally, NADG Hopewell Inc., an Ohio-based dental practice network affiliate of NADM - the same vendor of PDA that experienced the phishing incident - reported an email hacking breach to HHS that it said affected more than 1,100 individuals.
Click to expand...

guest · Oct 23, 2021

UNC Hospitals Notifies Patients that Former Employee Used Patient Information for Personal Gain
October 20, 2021
https://www.businesswire.com/news/h...ee-Used-Patient-Information-for-Personal-Gain

UNC Hospitals announced that it has mailed letters to 719 patients whose information may be at risk for identity theft.

On September 10, 2021, UNC Hospitals learned that one of its employees was using patient information for personal financial gain. The employee was responsible for handling payments from patients for services rendered by certain clinics of UNC Hospitals. The now former employee had access to patient demographic information including Social Security numbers, as well as copies of patient driver’s licenses and insurance cards.
Click to expand...

guest · Oct 24, 2021

Waikato DHB failed OIA requirements over cyber security breach – Ombudsman
October 24, 2021
https://www.stuff.co.nz/national/he...rements-over-cyber-security-breach--ombudsman

A district health board has failed to meet its requirements under the Official Information Act, prompting intervention from the Chief Ombudsman.

Waikato District Health Board largely ignored a series of questions from Local Democracy Reporting in June regarding the cyber security breach that paralysed the DHB in May, forcing the postponement of surgeries and relocation of some cancer patients.
Hackers stole personal patient and staff information during the breach and later dumped swathes of data on the Dark Web for anyone to access.
Click to expand...

However Chief Ombudsman Peter Boshier investigated the case and did not agree with the DHB’s approach.
“As a result, I have formed the final opinion that there has been a failure to meet the requirements imposed by the OIA,” he wrote.
Click to expand...

guest · Oct 26, 2021

Fullerton Health vendor's server hacked; personal details of customers sold online
October 25, 2021
https://www.straitstimes.com/singap...ked-personal-details-of-customers-sold-online

Personal details of Fullerton Health customers were stolen by hackers and hawked online, after a vendor of the private healthcare group suffered a breach earlier this month.

The data was put up for sale on hacking forums from Oct 11, and could be bought for US$600 (S$810) in Bitcoin. However, checks by The Straits Times showed that the hackers took down the posts on the data sale last Friday (Oct 22).
Click to expand...

The breach was of a server used by Agape Connecting People, a social enterprise that provides contact centre services.
Agape was engaged as a vendor to handle bookings by Fullerton Health customers.

Responding to queries from ST, Fullerton Health confirmed that its own networks were not compromised, and it is still trying to establish the exact number and identities of those affected.
Click to expand...

guest · Oct 28, 2021

Judge rules in favor of UMMC in trial against former employees who stole patient records
October 27, 2021
https://www.wjtv.com/news/local/jud...t-former-employees-who-stole-patient-records/

A federal judge has ruled in favor of the University of Mississippi Medical Center (UMMC) over litigation against three former employees who stole patient medical records for their own use and then lied about possessing them for years.

U.S. District Judge Carlton Reeves on Oct. 8 issued a default judgment in the federal trade secrets lawsuit, saying the defendants’ “clear, persistent pattern of perjury, evidence destruction, and concealment” warranted the default judgment.
Click to expand...

Over the course of the next few months, Sullivan coordinated with other UMMC staff —namely co-defendants Linnea McMillan and Kathryn Sue Stevens — to prepare for the new clinic’s opening.
This spreadsheet included patients’ birthdate, diagnosis, prescriptions, dose and frequency, insurance, pharmacy and home and mobile telephone numbers.

Sullivan resigned from his position at UMMC in June 2016, and then used the records stolen from UMMC to solicit these patents to continue their treatment at Sullivan’s new clinic in Madison called Mississippi Center for Advanced Medicine.
Click to expand...

All three defendants continued to deny taking or possessing “the List” until March 2020, when Harris admitted to lying in her deposition and produced 1,469 pages of text messages sent by herself and fellow defendants that revealed they had conspired to shred the stolen documents, violating the clinic’s policy against destroying patient information.
Click to expand...

guest · Oct 29, 2021

Misconfigured Database Leaks 880 Million Medical Records
October 29, 2021
https://www.infosecurity-magazine.com/news/misconfigured-database-leaks-880-m/

Researchers have found an unsecured database leaking over 886 million sensitive patient records online.

The non-password-protected data trove was found by Jeremiah Fowler and Website Planet and traced to healthcare AI firm Deep 6 AI, which fixed the privacy snafu promptly after it was responsibly disclosed.
Deep 6 AI applies intelligent algorithms to medical data to help find patients for clinical trials within minutes.
Click to expand...

The exposed data included date, document type, physician note, encounter IDs, patient ID, note, UUID, patient type, note ID, date of service, note type, and detailed note text.
The notes and physician information were stored in plain text, meaning anyone who discovered the database could have accessed intimate details of patient illnesses.
Click to expand...

Website Planet: Report: Medical AI Company Exposed Millions of Records Online

Security researcher Jeremiah Fowler together with the Website Planet research team discovered a non-password protected database that contained 886,521,320 records. The total size of the dataset was 68.53 GB and contained medical related data. Upon further research there were multiple references to Deep6.AI including internal emails and usernames. We immediately sent a responsible disclosure notice and public access was restricted shortly after. The records appear to contain data of those based in the United States.
Click to expand...

guest · Oct 29, 2021

Healthcare System Phishing Breach Affects 209,000
Academic Medical Center Says Access to Email Accounts Lasted Months
October 29, 2021
https://www.databreachtoday.com/healthcare-system-phishing-breach-affects-209000-a-17824

Massachusetts-based UMass Memorial Health is the latest large healthcare network to report an email phishing incident that potentially compromised hundreds of thousands of individuals' protected health information.

The unauthorized access to "a limited number" of employee email accounts lasted about seven months - from June 24, 2020, to Jan. 7 2021 - before it was detected, Worcester, Massachusetts-based UMass Memorial says in a breach notification statement posted on its website.
Click to expand...

UMass Memorial Health, which includes an academic medical center, three other hospitals and a medical group, reported to the Department of Health and Human Services on Oct. 15 an email hacking incident affecting more than 209,000 individuals, according to HHS' Office for Civil Rights' HIPAA Breach Reporting Tool website. Commonly called the "wall of shame," the website lists health data breaches affecting 500 or more individuals.
Click to expand...

guest · Nov 1, 2021

Canadian province health care system disrupted by cyberattack
November 1, 2021
https://www.bleepingcomputer.com/ne...-health-care-system-disrupted-by-cyberattack/

The Canadian provinces of Newfoundland and Labrador have suffered a cyberattack that has led to severe disruption to healthcare providers and hospitals.

The attack took place on October 30th, causing regional health systems to shut down their networks and cancel thousands of medical appointments. This outage affected health systems in Central Health, Eastern Health, Western Health, and the Labrador-Grenfell Regional Health authorities.
The IT outage also affected communications in the region, with people reporting an inability to reach the health care centers or 911 via phone.
Click to expand...

Likely a ransomware attack
While the Canadian government or healthcare systems have not disclosed what type of cyberattack they have suffered, sources have told BleepingComputer that it is ransomware.

Health Minister John Haggie and Eastern Health CEO David Diamond spoke at a media conference earlier today, stating that the incident had a 'significant impact' and a 'damaged data center.'
Click to expand...

guest · Nov 3, 2021

Medical school exposes personal data of thousands of students
November 3, 2021
https://www.zdnet.com/article/medical-school-exposes-personal-data-of-thousands-of-students/

A US medical training school exposed the personally identifiable information (PII) of thousands of students.

On Wednesday, vpnMentor published a report on the security incident, in which an unsecured bucket was left exposed online.
The server, which did not have authentication controls in place and was, therefore, accessible by anyone to view, contained 157GB of data, or just under an estimated 200,000 files.
Click to expand...

The unsecured Amazon S3 bucket contained a variety of PII including ID card and driver license copies, as well as CVs, revealing names, dates of birth, genders, photos of students, home addresses, phone numbers, email addresses, and both professional and educational summaries.
[/quote9
Click to expand...

guest · Nov 3, 2021

California Clinic Network Cyber Incident Affects 656,000
A Nevada Cancer Center Is Also Dealing With the Aftermath of an Attack
November 2, 2021
https://www.databreachtoday.com/california-clinic-network-cyber-incident-affects-656000-a-17839

A recent cyberattack on Community Medical Centers, a network of nonprofit neighborhood health centers in Northern California, has potentially compromised the personally identifiable information and protected health information of more than 656,000 individuals.

Meanwhile, Nevada-based Las Vegas Cancer Center is also reportedly notifying thousands of current and former patients that their data may have been compromised in a ransomware attack that happened during Labor Day weekend.

"As long as threat actors continue to be successful with these type of attacks, not only will they not end, but they will continue to grow and become more prominent, more serious and more intrusive," says retired FBI supervisory agent Jason G. Weiss, an attorney at Faegre Drinker Biddle & Reath.
Click to expand...

In a breach notification report provided to the Maine attorney general's office on Friday, Community Medical Centers says 656,047 individuals, including eight Maine residents, were affected by an "external hacking incident."
Click to expand...

guest · Nov 3, 2021

Cyberattacks Reported by Family of Woodstock and Viverant
November 3, 2021
https://www.hipaajournal.com/cyberattacks-reported-by-family-of-woodstock-and-viverant/

Family of Woodstock (FOW), a New York provider of crisis intervention, information, prevention, and support services, has suffered a cyberattack in which the protected health information of 8,214 individuals was potentially compromised.

The cyberattack was detected on August 3, 2021, and rapid steps were taken to eject the attackers from its network and restore its systems and operations. Third-party forensic investigators were engaged to determine the nature and scope of the breach, with the initial phase of the investigation concluding on September 11, 2021.
FOW said the investigation confirmed the attackers had access to parts of its network that contained protected health information such as first and last names, addresses, telephone numbers, email addresses, dates of birth,
Click to expand...

Physical Therapy Center Notifies 6,500 Patients of PHI Exposure
Viverant PT, LLC, a Minneapolis, MN-based physical therapy center, is notifying 6,500 current and former patients about a March 2021 cyberattack that exposed their protected health information.

The breach was detected on March 9, 2021, when suspicious emails were sent from an employee’s email account. The email account was immediately secured and steps were taken to address and contain the breach. A comprehensive review was conducted of its email environment, which confirmed only one email account had been breached but that it contained a wide range of sensitive data.
No evidence was found to indicate any attempted or actual misuse of patient data, but the possibility of data theft could not be ruled out.
Click to expand...

guest · Nov 4, 2021

Ransomware Incidents Among Largest Breaches on Federal Tally
Analysis of Latest Health Data Breaches on the HHS OCR 'Wall of Shame'
November 3, 2021
https://www.databreachtoday.com/ransomware-incidents-among-largest-breaches-on-federal-tally-a-17846

Ransomware incidents are becoming a major cause of health data breaches affecting millions of individuals that have been reported so far in 2021, according to the latest additions to the federal tally.

As of Wednesday, the Department of Health and Human Services' HIPAA Breach Reporting Tool website shows that the top 10 largest breaches posted to the tally so far in 2021 were all hacking/IT incidents.
Of those incidents, at least five - affecting a total of nearly 8 million individuals - were publicly disclosed as involving ransomware.
Click to expand...

That includes one of the largest breaches added to the tally in recent days: an August ransomware incident reported by Indiana-based Eskenazi Health to HHS on Oct. 1 as a HIPAA breach affecting more than 1.5 million individuals.

"No doubt ransomware is on the rise," in healthcare, as well as in other sectors, says Jim Van Dyke, a senior vice president at security firm Sontiq, which analyzes and rates the severity of data breaches based on the type of information compromised.
Click to expand...

guest · Nov 4, 2021

Seneca Family of Agencies (“Seneca”) - Notice of Data Breach
October 22, 2021
https://senecafoa.org/notice-of-data-breach/

On August 27, 2021, Seneca Family of Agencies (“Seneca”) discovered that certain parts of our network may have been accessed by an unauthorized individual and we launched an investigation. The investigation determined that an individual accessed our network for a brief period of time between August 25th and August 27th, 2021. Therefore, in an abundance of caution, we reviewed our network to determine the type of data present. Although we have no evidence to suggest actual or attempted misuse of information as a result of this incident, we are notifying individuals with information contained within the network.

The type of information varies by individual, but includes name and one or more of the following data elements: date of birth, Social Security number, address, phone number, email address, medical record number, treatment/ diagnosis information, health insurance information, Medicare/ Medicaid number, provider name, prescription information, driver’s license/state identification number, and digital signature.
Click to expand...

guest · Nov 4, 2021

PHI of 45,262 Desert Pain Institute Patients Potentially Compromised in Cyberattack
November 4, 2021
https://www.hipaajournal.com/phi-of...ients-potentially-compromised-in-cyberattack/

Baywood Medical Associates, doing business as Desert Pain Institute (DPI) in Mesa, AZ, has discovered unauthorized individuals gained access to parts of its computer network that contained the protected health information of patients.

The security breach was detected and stopped by DPI on September 13, 2021, and a third-party cybersecurity company was engaged to assist with the investigation and determine the nature and scope of the cyberattack. On October 15, 2021, the forensic investigators confirmed evidence was found indicating the attackers had accessed parts of its network where patients’ protected health information was stored.
Click to expand...

The incident has not yet appeared on the Department of Health and Human Services’ Office for Civil Rights breach portal, but the breach notification provided to the Maine attorney general indicates the protected health information of 45,262 individuals was potentially compromised.
Click to expand...

guest · Nov 5, 2021

Philips healthcare infomatics solution vulnerable to SQL injection
November 5, 2021
https://www.bleepingcomputer.com/ne...omatics-solution-vulnerable-to-sql-injection/

The Philips Tasy EMR, used by hundreds of hospitals as a medical record solution and healthcare management system, is vulnerable to two critical SQL injection flaws.
The vulnerabilities are tracked as CVE-2021-39375 and CVE-2021-39376, and both have a severity score of 8.8 in CVSS v3.

CISA has also released an advisory for the product, as it's widely deployed in many public and private health institutes, mainly in Argentina, Brazil, Colombia, Mexico, and the Dominican Republic.

"Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents," warned the advisory from CISA.
Click to expand...

Data leaks in healthcare
The Tasy EMR product holds sensitive medical records, patient care histories, medical supply details, financial and billing info, and general hospital management data.

As it is a central point for holding sensitive data, compromising it would lead to the exposure of a large number of people.
This becomes particularly problematic when hospitals are often forced to care for emergency patients without receiving consent for data processing.
Click to expand...

guest · Nov 5, 2021

Nationwide Laboratory Services Ransomware Attack Affects 33,000 Patients
November 5, 2021
https://www.hipaajournal.com/nation...ces-ransomware-attack-affects-33000-patients/

Boca Raton, FL-based Nationwide Laboratory Services, which was acquired by Quest Diagnostics in the summer, was the victim of a ransomware attack earlier this year.

Nationwide Laboratory Services detected a breach of its systems on May 19, 2021, when ransomware was used to encrypt files across its network and prevent files from being accessed. Steps were immediately taken to contain the attack and a third-party cybersecurity firm was engaged to assist with the investigation and remediation efforts.
Click to expand...

The forensic investigation confirmed on August 31, 2021, that the attackers gained access to parts of its network where patients’ protected health information was stored, and potentially accessed information such as names, dates of birth, lab test results, medical record numbers, Medicare numbers, and health insurance information. A subset of the individuals affected had their Social Security numbers exposed.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates the protected health information of up to 33,437 individuals was potentially compromised.
Click to expand...

guest · Nov 8, 2021

PHI of 320,000 Patients Potentially Compromised in EHR Vendor Hacking Incident
November 8, 2021
https://www.hipaajournal.com/phi-of...y-compromised-in-ehr-vendor-hacking-incident/

QRS Inc, a Tennessee-based healthcare technology services company and provider of the Paradigm practice management and electronic health records (EHR) solution, has announced a data breach involving the protected health information (PHI) of almost 320,000 individuals. The cyberattack was detected on August 26, 2021, three days after a server was breached.

QRS explained in its breach notification letters that a hacker gained access to the electronic patient portal and potentially accessed and exfiltrated the PHI of patients of some of its healthcare provider clients.
Click to expand...

guest · Nov 9, 2021

PHI Potentially Compromised in Hacking Incidents at Four Healthcare Providers
November 9, 2021
https://www.hipaajournal.com/phi-po...cking-incidents-at-four-healthcare-providers/

Four healthcare providers have recently announced their IT systems have been compromised and patient data may have been accessed.
Hacker Gains Access to Server of New York Psychotherapy and Counseling Center
New York Psychotherapy and Counseling Center (NYPCC), an NYC-based non-profit mental health services provider, has announced it was the victim of a cyberattack that was discovered on September 11, 2021.
A review of the files on the server revealed the following information may have been compromised: names, dates of service, addresses, Medicaid IDs, and dates of birth. NYPCC said it is committed to continually reviewing and updating its security protocols related to the protected health information of patients.
The Urology Center of Colorado Network Accessed by Unauthorized Individual
The Urology Center of Colorado (TUCC) has discovered parts of its computer network have been accessed by an unauthorized individual. The security breach was detected and blocked on September 8, 2021, with the breach investigation confirming the attack started the previous day.
Click to expand...

Mowery Clinic Alerts Patients About September 2021 Cyberattack
Mowery Clinic in Salina, KS, has started notifying certain patients about a cyberattack that was detected on September 14, 2021. Action was immediately taken to secure its systems and prevent further unauthorized access and a third-party cybersecurity firm was engaged to conduct a forensic investigation.
Prairie Lakes Healthcare System Says Hacker Gained Access to Some of Its IT Systems
Watertown, S.D.-based Prairie Lakes Healthcare System has discovered an unauthorized individual has gained access to a small number of its IT systems.

The healthcare system learned of the attack on October 6, 2021, when it experienced disruption to parts of its network.
Click to expand...

guest · Nov 9, 2021

Medical software firm urges password resets after ransomware attack
November 9, 2021
https://www.bleepingcomputer.com/ne...rges-password-resets-after-ransomware-attack/

Medatixx, a German medical software vendor whose products are used in over 21,000 health institutions, urges customers to change their application passwords following a ransomware attack that has severely impaired its entire operations.

The firm clarified that the impact has not reached clients and is limited to their internal IT systems and shouldn't affect any of their PVS (practice management systems).
However, as it is unknown what data was stolen during the attack, threat actors may have acquired Medatixx customers' passwords.
Click to expand...

Still recovering from attack
There's no estimate for when the company will return to normal operational status.

Finally, it has not been determined if the actors managed to exfiltrate any client, doctor, or patient data. However, the company states they informed Germany's data protection authority has about the incident and will issue an update after the investigations are concluded.

"It is not known at this point whether or not, and to what extent any data was stolen. It can therefore not be ruled out that the data stored by us has been stolen," Mediatixx explained in the translated advisory.
Click to expand...

According to Heise Online, Mediatixx solutions are used in about 25% of all medical centers in Germany, and this could be the biggest cyberattack ever to hit the country's healthcare system.
Click to expand...

guest · Nov 10, 2021

mood said: ↑

Canadian province health care system disrupted by cyberattack
November 1, 2021
https://www.bleepingcomputer.com/ne...-health-care-system-disrupted-by-cyberattack/
Click to expand...

Canadian hospitals recovering from breach that forced thousands of appointment cancellations
November 10, 2021
https://www.cyberscoop.com/newfoundland-labrador-canada-cyberattack-health-it-systems/

Intruders accessed patient and employee data after infiltrating health-releated IT systems in a breach that’s only now coming into focus.

A security incident affecting the province of Newfoundland and Labrador, first detected Oct. 30, took down multiple health networks, leading to the cancellation of thousands of appointments, including for chemotherapy treatments. The regional Eastern Health authority, which employees 13,000 people, on Tuesday announced that its email system was again functioning, more than a week after the initial compromise became known.
Click to expand...

“As part of the on-going investigation into a cyberattack that impacted health care IT systems in Newfoundland and Labrador, it has been determined that some personal information and personal health information was accessed from the systems,” the provincial government said in a Nov. 9 news release.
“A review is ongoing to determine if any other information is affected in the incident and further updates will be provided as appropriate.”

Canadian government officials have not said who is suspected in the latest incident, or whether ransomware was involved.
Click to expand...

guest · Nov 12, 2021

Two healthcare vendors to pay $190K settlement over breach, HIPAA failure
November 12, 2021
https://www.scmagazine.com/analysis...pay-190k-settlement-over-breach-hipaa-failure

For the second time in a month, the New Jersey attorney general announced a settlement over the compromise of protected health information and potential violations of the New Jersey Consumer Fraud Act and the Health Insurance Portability and Accountability Act. The attorney general suspended $65,000 from the settlement “provided the companies comply with the terms of the consent order.”

On Oct. 12, the state’s attorney general reached a $495,000 settlement with Diamond Institute for Infertility and Menopause to resolve allegations of lax cybersecurity practices after a healthcare data breach impacting 14,633 patients in 2017.
Click to expand...

The newest settlement was brought against two mailing and printing vendors, Command Marketing Innovations and Strategic Content Imaging. The healthcare business associates agreed to pay $130,000 in penalties and implement new security policies to resolve the allegations that stemmed from a 2016 patient data breach that affected 55,715 state residents.

The New Jersey investigation into the vendors found that both violated the state’s privacy regulation and HIPAA, by failing to ensure the confidentiality of ePHI and protect against reasonably anticipated unauthorized PHI disclosure, along with failing to review and modify security measures as needed in accordance with those regulations.
Click to expand...

guest · Nov 13, 2021

mood said: ↑

'Human error' exposed health information of 9,000 children: Manitoba government
August 28, 2020
https://winnipeg.ctvnews.ca/human-e...-9-000-children-manitoba-government-1.5083156
Click to expand...

Province sued over privacy breach involving 9,000 children
November 11, 2021
https://www.cbc.ca/news/canada/manitoba/manitoba-privacy-breach-lawsuit-wfpcbc-wfp-1.6245819

A class-action lawsuit will proceed against the province after confidential information about nearly 9,000 children with disabilities was mistakenly sent to agencies that provide services to them and community advocates.

An email notice was delivered to potential claimants this week notifying them about the class action. Court records show a judge certified the lawsuit as a class action early last summer.
To read more on this story from the Winnipeg Free Press, click here.
Click to expand...

guest · Nov 16, 2021

Officials confirm patient data stolen in N.L. cyberattack
November 16, 2021
https://ca.movies.yahoo.com/officials-confirm-patient-data-stolen-233813668.html

Officials have confirmed that personal information of medical patients in Newfoundland and Labrador has been stolen in the cyberattack that has wreaked havoc on the provincial health-care system for over two weeks.

While speaking with reporters on Monday, Justice Minister John Hogan said it was his understanding that both patient and employee data have been taken in the attack.
Click to expand...

The news follows Friday's update, where he said that employee data had been taken, but said the investigation had not yet determined if patient data had also been stolen. A spokesperson clarified that the situation changed following the Friday update, and the investigation was able to confirm that patient data had been stolen.
Click to expand...

guest · Nov 16, 2021

PHI of 1.27 Million Patients Compromised in Two Healthcare Data Breaches
November 16, 2021
https://www.hipaajournal.com/phi-of...-compromised-in-two-healthcare-data-breaches/

The protected health information of 1,271,642 individuals has been exposed and potentially stolen in two healthcare hacking incidents that were recently been reported to the Department of Health and Human Services’ Office for Civil Rights.
PHI of 688,000 Individuals Compromised in Sea Mar Community Health Centers Hack
Sea Mar Community Health Centers is a nonprofit community-based provider of health, human, housing, educational, and cultural services to underserved communities in Washington state.

On June 24, 2021, Sea Mar learned sensitive data had been exfiltrated from its IT systems by an unauthorized individual. Assisted by a leading third-party cybersecurity firm, Sea Mar determined its systems had been accessed between December 2020 and March 2021.
Click to expand...

Utah Imaging Associates Reports 583,643-Record Data Breach
On November 3, 2021, Utah Imaging Associates reported a data breach to the HHS’ Office for Civil Rights that involved the protected health information of 583,643 individuals. The breach has been listed as a hacking/IT incident involving PHI stored on a network server.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches