Baptist Medical Center and Resolute Health Hospital informed patients that their network was infected with malicious code in April, potentially resulting in PHI exposure.
Texas-based Baptist Medical Center and Resolute Health Hospital informed an undisclosed number of patients that its network was infected with malicious code, potentially resulting in protected health information (PHI) exposure.
The two hospitals, run by Baptist Health System, discovered the incident on April 20, 2022. After suspecting unauthorized network activity, the hospitals immediately suspended user access and put “extensive cybersecurity protection protocols” in place, the notice stated.
Further investigation revealed that an unauthorized third party accessed certain systems and removed data from the network between March 31 and April 24.
The information involved in the incident included demographic information, Social Security numbers, health insurance information, medical record numbers, diagnosis information, dates of service, and billing and claims information.
“We take the security of personal information seriously. As soon as the incident was discovered, a forensic investigation was immediately launched, law enforcement was contacted, and steps were taken to mitigate and remediate the incident and to help prevent further unauthorized activity,” the notice stated.
“In response to this incident, security and monitoring capabilities are being enhanced and systems are being hardened as appropriate to minimize the risk of similar incidents in the future.”
Call Center Service Reports Healthcare Data Breach
DialAmerica Marketing, a New Jersey-based call center service, reported a breach to HHS that impacted 19,796 individuals. According to its website, the company serves nearly 25 percent of the top health plan providers.
A sample notice posted on the Vermont Attorney General’s Office website said that DialAmerica discovered “anomalous activity” on its network on July 4, 2021. An investigation revealed that an unauthorized actor potentially viewed or took data from those systems between February 2, 2021 and July 9, 2021.
DialAmerica concluded its review of information within the systems on February 4, 2022, and said it was not aware of any misuse of the information, which included names, addresses, and other data that was not included in the sample breach notice.
90 Degree Benefits Wisconsin Suffers Data Security Incident
90 Degree Benefits’ Wisconsin location began notifying an undisclosed number of individuals of a data security incident that it discovered in late February 2022. The organization manages employee benefit plans for more than 100,000 plan members.
Investigators could not determine whether any information was actually viewed, but they did learn that an unauthorized actor accessed personal information. The information potentially included names, Social Security numbers, addresses, dates of birth, phone numbers, and health information. 90 Degree Benefits said that it notified the FBI and OCR.
“The security of our members’ personal information is of the utmost importance, and we deeply regret that this data security incident occurred,” the notice stated.
CYBERSECURITY NEWS
Health Plan Email Phishing Attack Exposes Student PHI
A Microsoft Office 365 email phishing attack exposed students' PHI.
Source: Getty Images
By August 05, 2021 - A student health insurance plan, which provides services to over 230 higher education institutions nationwide, is the victim of an email phishing attack that led to the breach of students’ protected health information (PHI.)
On August 4, Academic HealthPlans, Inc. (AHP) published a data incident notification, alerting students to the cyberattack.
After an investigation, “AHP determined that an email phishing attack that targeted AHP employees may have resulted in unauthorized access to emails and attachments in the two employees’ email accounts,” the notice states. “Although no evidence was found during the investigation that indicated that any emails in the employees’ accounts were in fact acquired or accessed, AHP could not rule out that possibility.”
Dig Deeper
- Healthcare Data Breaches Most Common Threats to Date in 2021
- PwnedPiper Vulnerabilities Impact Over 3K Hospitals in North America
- Health IT Security Challenges Persist for Hospital Systems
AHP concluded its investigation on June 4 and determined the phishing incident occurred between August 6, 2020 and August 24, 2020 and again on October 2, 2020.
“The investigation confirmed that the unauthorized access was limited to AHP’s cloud-based, Microsoft Office 365 email system and did not involve AHP’s enrollment waiver platform or any other AHP systems,” the notice states.
After an extensive review, “AHP then correlated the results of this data review with its files to identify the health plans and self-insured universities associated with the information.”
The review determined that the emails contained information about students, including names, dates of birth, Social Security numbers, health insurance member numbers, claims information, and diagnoses and treatment information.
CYBERSECURITY NEWS
Health Plan Email Phishing Attack Exposes Student PHI
A Microsoft Office 365 email phishing attack exposed students' PHI.
Source: Getty Images
August 05, 2021 - A student health insurance plan, which provides services to over 230 higher education institutions nationwide, is the victim of an email phishing attack that led to the breach of students’ protected health information (PHI.)
On August 4, Academic HealthPlans, Inc. (AHP) published a data incident notification, alerting students to the cyberattack.
After an investigation, “AHP determined that an email phishing attack that targeted AHP employees may have resulted in unauthorized access to emails and attachments in the two employees’ email accounts,” the notice states. “Although no evidence was found during the investigation that indicated that any emails in the employees’ accounts were in fact acquired or accessed, AHP could not rule out that possibility.”
You must be logged in to post a comment.