HIPAA Journal

SEPTEMBER 12, 2023

Schneck Medical Center has agreed to pay a penalty of $250,000 to resolve alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and state laws and will implement additional safeguards to prevent further data breaches.

HIPAA 94

HIPAA Ransomware Health Insurance Fraud 94

HIPAA Journal

JANUARY 2, 2023

The settlements pursued by the Department of Health and Human Services’ Office for Civil Rights (OCR) are for egregious violations of HIPAA Rules. Settlements are also pursued to highlight common HIPAA violations to raise awareness of the need to comply with specific aspects of HIPAA Rules. Are Data Breaches HIPAA Violations?

HIPAA 110

HIPAA Compliance Hospitals Medicare 110

HIPAA Journal

JANUARY 5, 2023

Back in June 2022 , HIPAA Journal reported on a cyberattack on Fitzgibbon Hospital in Marshall, MO, after being contacted directly by a spokesperson for a threat group called DAIXIN Team, who claimed responsibility for the attack. Howard Memorial Hospital Announces December 2022 Cyberattack.

Ransomware 121

Ransomware Hospitals HIPAA Licensing 121

HIPAA Journal

MAY 24, 2022

In March 2022, Partnership HealthPlan of California (PHC) announced that third-party forensic specialists had been engaged to help restore the functionality of its IT systems following a cyberattack. According to the notification, the cyberattack was detected on or around March 19, 2022.

Ransomware 136

Ransomware Licensing HIPAA Health Insurance 136

HIPAA Journal

JANUARY 9, 2023

Legacy Operating Company, an Alabama-based operator of Legacy Hospice facilities in Alabama, Arkansas, Louisiana, Mississippi, Missouri, Oklahoma, and Tennessee, has confirmed that an unauthorized third party gained access to a limited number of employee email accounts on February 11, 2022, and between April 7, 2022, and April 21, 2022.

Licensing 117

Licensing HIPAA Health Insurance Governance 117

HIPAA Journal

OCTOBER 17, 2022

Valle de Sol did not state in its notification letters when hackers gained access to its network, or for how long they had access, but did confirm that the unauthorized activity was detected on January 25, 2022. A comprehensive review was conducted of all files that may have been accessed, which was completed on July 18, 2022.

Health Insurance 121

Health Insurance Licensing Fraud HIPAA 121

HIPAA Journal

APRIL 7, 2022

In its March 25, 2022, breach notification letters, SuperCare Health explained that it identified unauthorized activity within its IT systems on July 27, 2021. A subset of individuals also had their Social Security numbers and/or driver’s license numbers exposed.

Licensing 132

Licensing HIPAA Health Insurance Hospitals 132

HIPAA Journal

JUNE 26, 2023

HIPAA enforcement discretion occurs when the Secretary for Health and Human Services (HHS) announces the Department will exercise discretion in the enforcement of HIPAA Rules. Typically, Notices of Enforcement Discretion last between 72 hours and 60 days, are state or region-specific and apply to specific provisions of the HIPAA Rules.

HIPAA 74

HIPAA COVID-19 COVID-19 Vaccine Public Health 74

HIPAA Journal

SEPTEMBER 30, 2022

Physicians Business Office (PBO), a Parkersburg, WV-based provider of medical practice management and administrative services, has recently disclosed a security incident that occurred in April 2022. That process was completed on September 16, 2022, and notification letters were sent shortly thereafter.

Licensing 112

Licensing HIPAA Health Insurance 112

HIPAA Journal

MARCH 1, 2022

Jax Spine and Pain Centers in Jacksonville, FL has recently announced it was the victim of a ransomware attack that occurred on January 24, 2022. The initial investigation concluded on January 28, 2022, and determined the attackers had gained access to its systems on or around December 15. Jax Spine & Pain Centers.

Ransomware 140

Ransomware Licensing HIPAA Health Insurance 140

Healthcare IT News - Telehealth

AUGUST 23, 2022

"In May and June 2022, MaineGeneral has achieved a CMS-CHF readmission rate of 0%, compared with 20% and 26.7% " In an effort to find a video technology that was easy to use for patients, MaineGeneral ended up with HIPAA-compliant Zoom as the video conferencing component for virtual care in outpatient settings.

COVID-19 193

COVID-19 Licensing Patient Satisfaction Hospitals 193

HIPAA Journal

MARCH 4, 2022

The security incident was detected on January 18, 2022, with the subsequent investigation confirming unauthorized individuals had access to its systems between November 18, 2021, and January 18, 2022. On January 25, 2022, CVS Pharmacy determined certain accounts had been compromised.

Health Insurance 127

Health Insurance Licensing HIPAA 127

HIPAA Journal

JANUARY 13, 2023

The attack was detected on November 7, 2022, and steps were taken to contain the attack and secure its systems. Notification letters were mailed to affected individuals on January 6, 2022. Notifications were mailed to affected individuals on December 30, 2022. The Kelberman Center – Email Account Breach.

Health Insurance 113

Health Insurance Licensing HIPAA Hospitals 113

HIPAA Journal

MARCH 23, 2022

Notification letters were sent to affected individuals on March 10, 2022. According to a March 10, 2022 data breach notice, Dialyze Direct said it discovered on February 14, 2022, that an unauthorized individual had gained access to an employee email account between January 21, 2021, and March 4, 2021. Highmark Inc.,

HIPAA 126

HIPAA Licensing Health Insurance Governance 126

HIPAA Journal

APRIL 15, 2022

A lawsuit has been filed against the in-home respiratory care provider, SuperCare Health, over a cyberattack and data breach that was reported to the Department of Health and Human Services on March 28, 2022. A subset of individuals also had their Social Security numbers and/or driver’s license numbers exposed.

Electronic Medical Records 122

Electronic Medical Records HIPAA Health Insurance Fraud 122

HIPAA Journal

MARCH 14, 2022

South Denver Cardiology Associates (SDCA) has recently announced it was the victim of a cyberattack in January 2022 in which files containing patient information were accessed and potentially stolen by hackers. Unusual network activity was detected on January 4, 2022, and the SDCA breach response process was immediately initiated.

COVID-19 107

COVID-19 HIPAA Licensing Health Insurance 107

HIPAA Journal

MAY 25, 2022

The break-in was discovered on March 4, 2022, with the subsequent investigation confirming on April 22, 2022, that six boxes of paper documents had been stolen from the facility, which included files relating to patients served by SAC Health in 1997 and between 2006 and 2020. Lifespan Services Suffers Ransomware Attack.

Ransomware 131

Ransomware Fraud HIPAA Licensing 131

HIPAA Journal

OCTOBER 7, 2022

On August 5, 2022, Anthem discovered that an unauthorized individual had gained access to a database and downloaded files containing plan members’ protected health information, including names, addresses, dates of birth, phone numbers, email addresses, Medicare ID numbers, and Medicaid ID numbers.

HIPAA 107

HIPAA Health Insurance Medicaid Medicaid 107

HIPAA Journal

MARCH 10, 2022

The breach was detected on January 20, 2022, and immediate action was taken to secure its systems, and an independent computer forensics company was engaged to conduct a forensic investigation to determine the nature and scope of the breach. Notification letters were sent on January 28, 2022. DataHealth. Dr. Douglas C.

Ransomware 130

Ransomware Licensing Health Insurance HIPAA 130

HIPAA Journal

JULY 5, 2022

The email system was immediately secured when the breach was detected with the forensic investigation confirming that two email accounts had been accessed by an unauthorized third party between January 12, 2022, and January 19, 2022. A limited number of patients also had financial account information exposed.

Licensing 109

Licensing Electronic Medical Records Health Insurance Hospitals 109

HIPAA Journal

SEPTEMBER 9, 2022

That process concluded on June 24, 2022. Those emails contained patient information such as names, dates of birth, Social Security numbers, medical information, health insurance information, driver’s license numbers, and state ID numbers. appeared first on HIPAA Journal.

Licensing 109

Licensing Health Insurance Fraud HIPAA 109

HIPAA Journal

FEBRUARY 16, 2022

The system contained patients’ names, birth dates, insurance card numbers, driver’s license numbers, and copies of patients’ insurance cards and driver’s licenses. The security breach was detected on or around January 9, 2022, when certain systems were rendered inaccessible.

Ransomware 128

Ransomware Hospitals Licensing HIPAA 128

HIPAA Journal

JULY 11, 2022

Phoenixville Hospital Fires Employee for HIPAA Violation. An employee was discovered to have accessed the medical records of several patients without authorization between October 2021 and May 2022, when there was no legitimate work reason for viewing those records. Patient medical records were not involved.

Hospitals 104

Hospitals HIPAA Health Insurance Licensing 104

HIPAA Journal

MAY 19, 2022

The settlement has received preliminary approval from the court and a final hearing for the settlement has been scheduled for September 12, 2022. The deadline for submitting a claim is August 8, 2022, and the deadline for objecting to the settlement or requesting to be excluded from the settlement is August 22, 2022.

Licensing 118

Licensing HIPAA Health Insurance Medicaid 118

HIPAA Journal

APRIL 13, 2022

The theft occurred on or around January 27, 2022, and was discovered by RHD on February 16, 2022. The data was uploaded to the leak site on March 17, 2022. Wellstar Health learned about the security breach on February 7, 2022, with the forensic investigation confirming that the breach was limited to two email accounts.

Ransomware 121

Ransomware HIPAA Licensing Health Insurance 121

HIPAA Journal

JULY 14, 2022

The attack was detected on March 20, 2022, and resulted in computer systems being disabled. The forensic investigation confirmed the breach was limited to a single employee email account, which was breached between January 27, 2022, and February 7, 2022.

Licensing 109

Licensing Health Insurance Ransomware HIPAA 109

HIPAA Journal

JUNE 24, 2022

On April 7, 2022, an employee responded to a phishing email and disclosed credentials for an email and messaging account. A limited number of individuals also had their Social Security numbers, driver’s license/state ID numbers, and/or financial account information exposed.

Ransomware 124

Ransomware Licensing HIPAA Health Insurance 124

HIPAA Journal

JUNE 9, 2022

A programmatic and manual review of the affected email account was completed on March 18, 2022. On March 29, 2022, Platinum Hospitalists discovered an email account had been accessed by an unauthorized individual. Platinum Hospitalists Discovers Phishing Attack and Data Breach.

Licensing 124

Licensing HIPAA Health Insurance Hospitals 124

HIPAA Journal

DECEMBER 14, 2022

A security breach was identified by Conifer in late March, with the investigation determining several Microsoft 365 had been accessed by unauthorized individuals between March 17 and March 22, 2022. CFA was informed about the breach on June 23, 2022. Patients started to be notified on November 23, 2022.

Health Insurance 117

Health Insurance HIPAA Licensing 117

HIPAA Journal

AUGUST 3, 2022

The two health insurance firms confirmed they had been affected in late February 2022, with PracticeMax publicly reporting the breach in the fall of 2021. Fast Track Urgent Care said it took until June 6, 2022, 13 months after the initial breach, for PracticeMax to confirm that Fast Track Urgent Care patient data had been accessed.

Ransomware 114

Ransomware Health Insurance Licensing HIPAA 114

HIPAA Journal

MARCH 29, 2023

On December 26, 2022, an employee’s laptop computer was stolen. Majestic Care – Hacking incident Majestic Care, a provider of community-based skilled nursing throughout Indiana, Ohio, and Michigan, has confirmed that it was the victim of a hacking incident in December 2022 that disrupted access to its information systems.

Hospitals 107

Hospitals Ransomware Licensing Health Insurance 107

Healthcare IT News - Telehealth

JUNE 27, 2023

They said customers who decline HIPAA consent on the website are prevented from completing their patient registration with Amazon Clinic and are redirected to a third-party provider information page.

HIPAA 152

HIPAA Telemedicine Licensing 152

HIPAA Journal

NOVEMBER 23, 2022

The attack occurred between January 26 and January 28, 2022, and while the attack was detected by the firm’s endpoint security solution shortly after the ransomware was executed, it was not possible to prevent the encryption of certain files on its network.

Ransomware 115

Ransomware Fraud Licensing HIPAA 115

Compliancy Group

APRIL 11, 2022

In one of the largest breaches reported in 2022 so far, SuperCare Health suffered a hacking incident affecting 318,379 patients. However, it took SuperCare Health until February 2022 to discover the incident had potentially compromised that patient information. Let’s Simplify Compliance HIPAA and cybersecurity go hand-in-hand.

US Department of Health and Human Services 98

US Department of Health and Human Services HIPAA Compliance Licensing 98

HIPAA Journal

JULY 20, 2022

While data theft could not be determined, the affected email accounts contained the protected health information of patients of 19 of its hospitals, including names, birth dates, health insurance information, Social Security numbers, driver’s license, and healthcare data. The lawsuit, filed in the Circuit Court of the City of St.

Fraud 119

Fraud Licensing HIPAA Health Insurance 119

HIPAA Journal

MARCH 30, 2022

That process concluded on February 25, 2022, when it was confirmed that files containing the personal and protected health information of plan members had been exfiltrated from its network. The attack appears to have occurred on or around March 10, 2022 and has affected the automatic refill line and mail order services of its pharmacy.

Ransomware 132

Ransomware Electronic Medical Records HIPAA Licensing 132

HIPAA Journal

APRIL 18, 2022

The types of information exposed included names, Social Security numbers, driver’s license numbers, state-issued I.D. It is unclear when the breach was detected; however, Contra Costa County said the breach investigation concluded on March 11, 2022, and notification letters were sent to affected individuals on April 15, 2022.

Licensing 118

Licensing HIPAA Health Insurance Hospitals 118