Roper St. Francis Healthcare has advised 189,761 patients regarding an unauthorized person who accessed some of their protected health information (PHI) located in employee email accounts. The provider discovered the email security breach at the end of October 2020. The investigation showed the compromise of three email accounts between October 14 and October 29, 2020.
An analysis of the email accounts was carried out to ascertain if there was potential access to information. It was impossible to make certain if the unauthorized individual viewed or exfiltrated patient data, though the attacker possibly got access to names, birth dates, patient account numbers, medical record numbers, and limited treatment and clinical data, including locations and dates of service, providers’ names, and billing details. The email accounts likewise included the health insurance data and Social Security numbers of selected patients.
Roper St. Francis Healthcare provided free credit monitoring and identity theft protection services to the persons whose Social Security number was likely compromised. Steps were undertaken to strengthen email security and workers were furnished with more training on email safety.
Einstein Healthcare Network Provides Supplemental Details Concerning the August 2020 Email Security BreachBreach
Einstein Healthcare Network in Pennsylvania is informing patients concerning a phishing attack that was uncovered last summer of 2020. The healthcare company manages medical centers in Elkins Park, East Norriton, and Philadelphia. Strange email account activity was noticed on August 10, 2020. Upon investigation of the occurrence, it was confirmed that an unauthorized individual accessed a number of employee email accounts from August 5, 2020 to August 17, 2020.
The network performed an evaluation of the compromised email accounts to find out whether they stored any patient information. The evaluation showed that the email messages and attachments had these types of patient information: Names, patient account numbers, medical record numbers, dates of birth, diagnoses, prescription drugs, types of treatment, provider names, and treatment locations. The types of data in the accounts were different from one patient to another. The Social Security numbers and medical insurance details of certain patients were likewise included.
It was impossible to ascertain if the unauthorized person had read or exfiltrated patient records while accessing the email accounts. Einstein Healthcare Network delivered a set of breach notification letters to persons possibly impacted by the incident beginning on October 9, 2020. The provider reported the breach to the HHS’ Office for Civil Rights as well. The OCR breach portal detailed the breach as affecting 1,821 patients.
Based on Einstein Healthcare Network’s substitute breach notice, the investigation ended on November 16, 2020. More letters had been sent by mail between January 21, 2021 and February 8, 2021.
Center for Alternative Sentencing and Employment Services Reports an Email Incident
The Center for Alternative Sentencing and Employment Services (CASES) located in New York found out the compromise of the email accounts of selected employees. Hackers accessed the email accounts from July 6 to October 4, 2020.
Upon investigation of the incident, CASES learned that the hackers exfiltrated email messages from the accounts including patient information. For the majority of patients, the stolen data included names, birth dates, medical record/client ID number, and certain clinical data associated with the care given by CASES. The hackers also stole the Social Security number, driver’s license number, and/or medical insurance details of a number of clients. CASES offered the affected people free credit monitoring and identity theft protection services.
The company likewise took steps to enhance email security and gave the employees additional security awareness training.
