Theft of Patient Schedules Results in Potential Exposure of PHI of 3,472 Anesthesia Associates of Kansas City Patients
Paperwork containing information on patients has been stolen from an Anesthesia Associates of Kansas City [...]
The HIPAA Guide - Celebrating Over 15 Years Online
Articles by Liam Johnson
New Rules on Patient Access and Information Blocking Proposed by ONC and CMS
The HHS’ Office of the National Coordinator for Health Information Technology (ONC) and the Centers for [...]
HIMSS Cybersecurity Survey Reveals Phishing and Legacy Systems Major Security Concerns
HIMSS has published the results of its annual cybersecurity survey. The aim of the survey is to identify [...]
Malware Attack on Pawnee County Memorial Hospital Impacts 7,000 Patients
Pawnee County Memorial Hospital located in Pawnee City, Nebraska, is notifying 7,038 patients that a hacker [...]
GDPR-Style Data Privacy Law Signed into California Legislature
California governor Jerry Brown has signed AB 375 – the California Consumer Privacy Act of 2018 – [...]
PHI of 24,000 Georgia Eye Associates Patients Exposed Due to EyeSouth Partners Email Account Breach
A hacker accessed the email account of an employee of EyeSouth Partners and potentially viewed or acquired [...]
What Information Does the HIPAA Law Protect?
To find the answer to the question what information does the HIPAA law protect, you have to look beyond the [...]
EHR Vendor to Pay $57.25 Million For False Claims Act Violation
Greenway Health LLC, an electronic health record (EHR) software developer based in Tampa, FL, has agreed to [...]
How to Improve Hospital Workflows
Achieving Workflow Optimization in Hospitals The matter of improving hospital workflows is a senior [...]
Wyoming Hospital Records Act of 1991 May be Repealed
Wyoming is contemplating repealing the Hospital Records Act of 1991. The act was created to make sure [...]
24,500 Patients’ PHI Exposed Due to Cyberattacks on Connecticut Eye Clinic and Chaplaincy Health Care
A ransomware attack on Dr. DeLuca Dr. Marciano & Associates, P.C., an eye care clinic located in [...]
IDenticard PremiSys Access Control System Vulnerabilities Identified
ICS-CERT has published an advisory about three vulnerabilities with a high severity rating that are affecting [...]
Data Breaches at Valley Professionals Community Health Center and Sunflower State Health Plan Impact 13,625 Patients
Valley Professionals Community Health Center in Indiana has experienced a phishing attack that has resulted [...]
Aetna Pays $935,000 to California AG to Settle HIV Status Breach Case
The Connecticut health insurer Aetna has agreed to pay a financial penalty of $935,000 to the California [...]
Illinois Biometric Information Privacy Act Allows Legal Action Over Violations Even Without Actual Harm
The Illinois Supreme Court has decided that state residents can file a lawsuit against a private entity when [...]
Hackers Can Exploit Vulnerabilities in Security Cameras
Hackers could exploit vulnerabilities in networked security and surveillance cameras to gain access to the [...]
Guidance for Medical Device Manufacturers Sharing Data with Patients Issued by FDA
The U.S. Food and Drug Administration (FDA) has released guidelines for medical device manufacturers who [...]
Ransomware Attack on FABEN Obstetrics and Gynecology Results in Patient Data Loss
FABEN Obstetrics and Gynecology in Jacksonville, FL has suffered a ransomware attack which has resulted in [...]
HSCC’s New Cybersecurity Framework for Medical Devices
The Healthcare and Public Health Sector Coordinating Council (HSCC) has published a new cybersecurity [...]
2018 Healthcare Data Breaches Analysis
Since October 2009, the Department of Health and Human Services’ office for civil Rights (OCR) has been [...]
PHI of 7,200 Integrity House Patients Stored on Stolen Computers
A break-in at the offices of addiction treatment services provider Integrity House had potentially resulted [...]
Software Updates Issued to Address KRACK Vulnerabilities Affecting Stryker Medical Beds
Cybersecurity vulnerabilities have been identified in Stryker Medical Beds which could potentially be [...]
Multiple Vulnerabilities Discovered in LabKey Server Community Edition
Tenable Research security researchers have discovered several flaws in LabKey Server Community Edition [...]
Critical Care, Pulmonary & Sleep Associates Email-Related Breach Impacts 23,300 Patients
A data breach at Critical Care, Pulmonary & Sleep Associates (CCPSA) in Colorado has impacted over 23,300 [...]
Alaska Department of Health and Social Services Breach Impacted 87,000 More Patients Than Previously Thought
In April 2018, the Alaska Department of Health and Social Services (ADHSS) discovered that malware had been [...]
HIPAA Compliance for HR Departments
HIPAA compliance for HR departments is necessary for healthcare and health insurance companies, but even [...]
All-Star Orthopaedics and Dermacare Brickell Data Breaches Impact 77,800 Patients
All-Star Orthopaedics has notified patients of Las Colinas Orthopedic Surgery & Sports Medicine in [...]
Radware Report Talks About Increasing Cost of Cyberattacks
Radware’s new report provides information regarding the threat landscape in 2018 and the dramatic [...]
Healthcare Data Breach Report for December 2018
December was the second-best month of 2018 for healthcare data breaches with only 23 healthcare data breaches [...]
Tougher Data Breach Notification Laws in North Carolina Sought By State AG
With the increasing number of data breaches impacting North Carolina residents in 2017, state representative [...]
US-CERT Issues Alert About Dräger Infinity Delta Patient Monitors Vulnerabilities
The U.S. Department of Homeland Security’s Industrial Control Systems Cyber Emergency Team (US-CERT) [...]
Valley Hope Association Alerts Patients About Email-Related Breach
Valley Hope Association has discovered that an unauthorized individual has gained access to an [...]
Revised Common Rule Now In Effect
The Federal Policy for the Protection of Human Subjects (45 CFR part 46), also called the Common Rule, has [...]
CMS Issues New Medicare Cards to Fight Fraud
People with Medicare have now been issued new Medicare cards that have no Social Security numbers printed on [...]
Patient Health Information at Risk Due to Security Failures of the Department of Defense Health Agency
According to a recently issued Department of Defense (DoD) Office of Inspector General report (PDF), the [...]
Doctor Gets Probation for Criminal HIPAA Violation Instead of a Jail Term
A doctor pleaded guilty to committing a criminal violation of HIPAA Rules for wrongfully disclosing the PHI [...]
Email-Related Breach at Lebanon VA Medical Center Exposed the PHI of 1,000 Patients
Lebanon VA Medical Center based in Pennsylvania found out that the protected health information (PHI) of [...]
New Data Breach Notification Law in Massachusetts Enacted
A new data breach notification law in Massachusetts was enacted on January 10, 2019. The new law was signed [...]
BenefitMall Email Security Breach: PHI of 111K Individuals Compromised
Centerstone Insurance and Financial Services, doing business as BenefitMall, has sent notifications to over [...]
HIPAA Compliance for Call Centers
HIPAA Compliant Texting in Call Centers HIPAA compliance for call centers is an important concern for all [...]
Boston Children’s Hospital DDoS Attacker Sentenced to 10 Years in Jail
Martin Gottesfeld, 34, of Somerville, MA, the hacker responsible for a Distributed Denial of Service (DDoS) [...]
Can Healthcare Professionals Use Personal Phones at Work Without Violating HIPAA?
There is a worrisome practice happening in healthcare centers throughout the country: The utilization of [...]
PHI of Sacred Heart Rehabilitation Center Patients Exposed Due to Phishing Attack
Sacred Heart Rehabilitation Center in Memphis, MI, provides substance abuse treatment and care services for [...]
Multiple Cybersecurity Failures Led to SingHealth’s 1.5-Million Records Breach
A healthcare data breach investigation revealed that failing to implement basic cybersecurity best practices [...]
Phishing Attack on Kent County Community Mental Health Authority Exposed Patient PHI
A targeted phishing attack on Kent County Community Mental Health Authority, dba Network180, began on October [...]
500 Patients of Solis Mammography Informed of Laptop Theft and PHI Exposure
Ben-Ora, Hansen, Vanesian Imaging Ltd, has announced that an unencrypted laptop computer used by a Solis [...]
Feds Launch Awareness Campaign on Private Sector Cyber Risks
The National Counterintelligence and Security Center (NCSC) at the at the Office of the Director of National [...]
How Employees Can Help Prevent HIPAA Violations
Healthcare institutions and their business associates must be in compliance with the HIPAA Privacy, Security, [...]
Hospitals Incur 64% Higher Advertising Costs After a Healthcare Data Breach
A new study has investigated how advertising expenditures are affected by healthcare data breaches. The [...]
Ransomware Attack on Business Associate of Blue Cross Blue Shield of Michigan
A ransomware attack on a business associate of Blue Cross Blue Shield of Michigan has potentially compromised [...]
Breaches at Podiatric Offices of Bobby Yee and Humana Impact 580,000 People
The Podiatric Offices of Bobby Yee experienced a ransomware attack on October 29, 2018. The attack resulted [...]
Increased Chinese Malicious Cyber Activity Prompts US-CERT to Issue IT Service Provider Warning
The Department of Homeland Security (DHS) United States Computer Emergency Readiness Team (US-CERT) has [...]
Phishing Attack on Orlando Family Physicians Group Impacts 8,400 Patients
Family Physicians Group in Orlando has informed 8,400 patients that a phishing attack has allowed hackers to [...]
2018 HIPAA Fines and Settlements Summary
This post is a summary of the 2018 HIPAA fines and settlements that have been agreed with either the [...]
4,309 Choice Rehabilitation Residents Impacted by Email Account Breach
Choice Rehabilitation of Creve Coeur, MO has announced that an unauthorized person has gained access to an [...]
HIPAA Security Officer
The Administrative Safeguards of the HIPAA Security Rule (45 CFR 164.308) require all Covered Entities to [...]
Voluntary Cybersecurity Best Practices for Healthcare Organizations Published by HHS
The U.S. Department of Health and Human Services (HHS) has published voluntary cybersecurity best practices [...]
PHI of Dental Center of Northwest Ohio Patients Exposed Due to Ransomware Attack
The Dental Center of Northwest Ohio located in Toledo, OH, has notified present and past patients that some [...]
Flowers Hospital to Pay $150,000 to Settle Data Breach Lawsuit
Flowers Hospital in Dothan, AL has agreed to settle a class action data breach lawsuit that was filed against [...]
The Three Most Prevalent Security Weaknesses in Healthcare
Clearwater has identified the most prevalent security weaknesses in healthcare from IRM analyses carried out [...]
Blue Cross Blue Shield of Michigan Informs 15,000 Customers About Data Breach
Blue Cross Blue Shield of Michigan has advised around 15,000 customers that some of their private and [...]
Summary of the Biggest Healthcare Data Breaches of 2018
This is a summary of the biggest healthcare data breaches of 2018. The healthcare data breaches referred to [...]
Risk Management Framework Updated by NIST
The National Institute of Standards and Technology (NIST) has released the final version of its updated Risk [...]
San Diego School District Phishing Attack Exposed the Data of Over 500,000 Staff and Students
The San Diego School District has announced that a phishing attack resulted in the exposure of the private [...]
HIPAA Encryption for iPhones and Android Phones
Should healthcare providers encrypt data in the smartphones they use? There is some misunderstanding [...]
What Are Covered Entities Under HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) is applicable to healthcare organizations and [...]
Lawsuit Filed Against LifeBridge Health Over Theft of PHI of 530,000 Patients
A lawsuit has been filed against LifeBridge Health over a breach of the protected health information (PHI) of [...]
McLean Hospital to Pay $75,000 HIPAA Violation Fine
Massachusetts Attorney General Maura Healey has fined McLean Hospital $75,000 for a data breach in 2015 that [...]
Court Ruled in Favor of Patient In Impermissible PHI Disclosure Lawsuit
An 11-year legal case filed after a woman’s healthcare records were released to her ex-boyfriend has at [...]
Healthcare Data Breach Report in November 2018
In November, 34 healthcare data breaches were reported to OCR, which makes it the second worst month of 2018 [...]
32,000 Patients’ PHI Potentially Exposed in Elizabethtown Community Hospital Email Breach
Around 32,000 patients of the University of Vermont Health Network’s Elizabethtown Community Hospital have [...]
HIPAA Privacy Laws
Objectives of HIPAA Privacy Laws HIPAA privacy laws were introduced in 2002 with the goal of ensuring the [...]
Credit Card Breach at BJC Healthcare and PHI Breach at CCRM Dallas-Fort Worth
BJC HealthCare, a large not-for-profit healthcare network in the U.S., has discovered hackers uploaded [...]
CMS Explains the Use of Text Messages in Healthcare
The Centers for Medicare and Medicaid Services (CMS) has confirmed to healthcare providers that using text [...]
Vulnerability Discovered in Medtronic Encore and CareLink Programmers
ICS-CERT issued a bulletin regarding a vulnerability that was found in some Medtronic CareLink and Encore [...]
Contra Costa Health Plan and Ramsey County Social Services PHI Breaches Reported
Contra Costa Health Plan (CCHP) is sending notifications to patients to alert them that some of their [...]
Study Reveals the Scale of Phishing Attacks and Value of Security Awareness Training
New research has revealed the scale of phishing attacks and the number of employees being misled by phishing [...]
PHI of 16,000 Mind & Motion Patients Potentially Compromised Due to Ransomware Attack
Mind & Motion Developmental Centers of Georgia has discovered hackers installed malware and ransomware on [...]
Intsights Found a Huge Number of Open and Misconfigured Healthcare Databases in the Cloud
Intsights, an enterprise threat management platform provider, conducted a survey which revealed an alarming [...]
EmblemHealth Fined $100,000 for HIPAA Violations
The New Jersey state attorney general’s office has fined the health insurance company [...]
Colorado Hospital to Pay $111,400 for Failure to Deactivate PHI Access of Former Employee
A Colorado hospital is to pay OCR $111,400 for failing to terminate the access of a former employee to its [...]
Frisco Medical Center Breach: Payment Information of 48,000 Patients Exposed
Baylor Scott & White Medical Center, located in Frisco, TX, has learned about a potential compromise of [...]
Malware Attack on the University of Maryland Medical System Successfully Thwarted
The University of Maryland Medical System discovered on December 9, 2018, that an unauthorized person [...]
Prairie Fields Family Medicine’s Email-Related Privacy Breach Impacts 6,450 Patients
Prairie Fields Family Medicine, based in Fremont, NE, is notifying 6,450 patients about the potential [...]
Philips HealthSuite Health Android App Vulnerability Discovered
The Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) [...]
18,000 People Affected by Three Separate Healthcare Security Breaches
Redwood Eye Center Ransomware Attack IT Lighthouse, the managed service provider hosting the electronic [...]
AMIA and AHIMA Want Adjustments to HIPAA to Improve Accessibility and Portability of Health Information
The American Medical Informatics Association (AMIA) and the American Health Information Management [...]
Summary of Ransomware Attacks on Healthcare Providers in Illinois and Rhode Island
This is a summary of healthcare ransomware attacks, security incidents and privacy breaches that have been [...]
PHI of 41,000 Cancer Treatment Centers of America Patients Potentially Exposed
Cancer Treatment Centers of America’s Western Regional Medical Center located in Bullhead City, AZ has [...]
Advanced Care Hospitalists Pays $500,000 to Settle Multiple HIPAA Violations
The HHS’ Office for Civil Rights (OCR) has investigated a case of impermissible disclosure of PHI by a [...]
ONC’s Easy EHR Issues Reporting Challenge Winners Announced
The Easy EHR Issues Reporting Challenge was launched by the Department of Health and Human Services’ Office [...]
Serious Security Vulnerabilities Identified at Arizona Managed Care Organizations
The Department of Health and Human Services’ Office of Inspector General (OIG) has conducted security [...]
PHI of 7,000 Georgia Spine and Orthopaedics of Atlanta Patients Exposed Due to Phishing Attack
Georgia Spine and Orthopaedics of Atlanta (GSOA) is notifying certain patients about the potential theft of [...]
Two Iranian Hackers Indicted for SamSam Ransomware Attacks
The U.S. Department of Justice (DOJ) has announced that two threat actors responsible for SamSam ransomware [...]
Partial Closure of Emergency Rooms at Two Hospitals Due to Ransomware Attack
East Ohio Regional Hospital (EORH) in Martins Ferry, OH and Ohio Valley Medical Center (OVMC) in Wheeling, WV [...]
Pennsylvania Supreme Court Reinstates UPMC Data Breach Lawsuit
The employees affected by a data breach at University of Pennsylvania Medical Center (UPMC) took legal action [...]
Technology Use in Healthcare Versus HIPAA Compliance
Why Modern Technology May Not be HIPAA Compliant A lot of healthcare professionals today use their mobile [...]
PHI of 7,000 Patients Exposed Due to Tandigm Health Website Vulnerability
Healthcare company Tandigm Health discovered a vulnerability on its website on September 25, 2018. The [...]
Over Half Of Healthcare Data Breaches Caused By Insiders
The healthcare industry is a target for hackers but while there have been many hacks and IT incidents, [...]
Allergy Practice in Hartford Fined $125,000 for Impermissible PHI Disclosure
The Department of Health and Human Services’ Office for Civil Rights (OCR) has settled potential HIPAA [...]
New Draft Paper on Telehealth and Remote Monitoring Device Cybersecurity Open for Feedback
The National Institute of Standards and Technology’s National Cybersecurity Center of Excellence (NCCoE) [...]
OIG Reports on Top Management and Performance Challenges of HHS
The Department of Health and Human Services’ Office of Inspector General (OIG) has released its yearly [...]
Healthcare Data Breach Report for October 2018
HIPAA Journal’s healthcare data breach report for October 2018 shows an increase in healthcare data [...]
Key Dental Group Notifies Patients of Potential HIPAA Violation
Key Dental Group in Pembroke Pines, FL is notifying patients about a possible HIPAA violation that could [...]
PHI of 4,458 Patients Stored on Stolen FHN Healthcare Laptop
FHN Healthcare, which manages FHN Memorial Hospital located in Freeport, IL and other family healthcare [...]
Episcopal Health Services Patients Impacted by Email Hacking Incident
St. John’s Episcopal Hospital and Episcopal Health Services in New York have notified past and present [...]
Greater Alignment of Federal Data Privacy Rules Needed
The American Medical Informatics Association (AMIA) is requesting the Health Insurance Portability and [...]
HHS Plans Request for Information to Discover Issues Hampering Patient Information Sharing and Care Coordination
The HHS has prepared a Request for Information (RFI) to find out how HIPAA Rules are obstructing the sharing [...]
Phishing Attack on Southwest Washington Regional Surgery Center Affects 2,393 Patients
A phishing attack on Southwest Washington Regional Surgery Center located in Vancouver, WA, resulted in the [...]
CISA Act Calls for New Cybersecurity Agency Inside DHS
The U.S. Department of Homeland Security will be forming a new agency exclusively focused on cybersecurity [...]
Upstate University Hospital Breach Impacts PHI of 1,216 Patients
Upstate University Hospital in Syracuse, NY, has informed 1,216 of its patients that a former hospital worker [...]
PHI of 94,000 People Exposed Due to HealthCare.gov Data Breach
The Centers for Medicare & Medicaid Services (CMS) reported last month that the HealthCare.gov website [...]
Ransomware Attack on May Eye Care Center Impacts 30,000 Patients
On July 29, 2018, May Eye Care Center, located in Hanover, PA, was attacked with ransomware. The ransomware [...]
Phishing Attack on Health First Compromised 42,000 Customers’ PHI
Health First Inc., a health system with four hospitals based in Florida, experienced a hacking/IT incident [...]
Former Chilton Medical Center Employee Sentenced for Theft of Computer Equipment
Sergiu Jitcu of Saddle Brook, NJ was a former IT employee of Chilton Medical Center in New Jersey. He was [...]
Healthcare Security Breaches from 2015 to 2017
The last three years have seen 955 major healthcare security breaches that resulted in the exposure and/or [...]
ICS-CERT Advisory on New Vulnerability in Philips iSite and IntelliSpace PACS
ICS-CERT released a bulletin concerning a medium severity vulnerability found in Philips iSite and [...]
Billing Information of 12,331 Inova Health System Patients Compromised
Inova Health System based in Falls Church, VA is informing 12,331 patients that there has been a breach of [...]
OIG Publishes Findings of Audit of FDA’s Policies and Procedures Covering Postmarket Cybersecurity Risk to Medical Devices
The HHS’ Office of Inspector General (OIG) has released the results of an audit of the policies and [...]
Roche Point of Care Handheld Medical Devices’ Vulnerabilities Detected
ICS-CERT has issued a warning about five vulnerabilities in Point of Care handheld medical devices [...]
Less Than a Third of Healthcare Organizations Have a Comprehensive Cybersecurity Program
The 2018 CHIME Healthcare’s Most Wired survey has revealed many healthcare organizations do not have a [...]
Healthcare Data Breach Report for Q3 2018
The Q3 Breach Barometer Report from Protenus shows a drop in the number of healthcare data breaches in Q3 [...]
The Most Common HIPAA Violations Healthcare Organizations Should be Aware Of
The most common HIPAA violations committed by healthcare organizations that have resulted in financial [...]
566,217 Customers of Bankers Life Impacted by Data Breach
Bankers Life, based in Chicago, is a health insurance company and the largest division of CNO Financial Group [...]
Healthcare Organizations Pummeled by SamSam Ransomware
The cybercriminals behind SamSam ransomware have been highly active this year. 67 organizations have been [...]
Business Associate Pays $200,000 to New Jersey for Virtua Medical Data Breach
Best Medical Transcription agreed to pay a $200,000 settlement to the New Jersey Attorney’s office to [...]
Beazley’s Q3 Breach Insights Reports Shows Increase in Ransomware Attacks
The Beazley’s Q3 Breach Insights Report shows there has been a significant increase in ransomware attacks [...]
OCR Recommends Cybersecurity Best Practices for Healthcare Organizations
The Department of Health and Human Services’ Office for Civil Rights has reminded healthcare organizations [...]
New Health Sector Cybersecurity Coordination Center Opened by HHS
The U.S. Department of Health and Human Services (HHS) has formally launched its Health Sector Cybersecurity [...]
Medicaid Data Breach Report for 2016 Published by OIG
The Department of Health and Human Services’ Office of Inspector General (OIG) has released a new report [...]
Potential Exposure of PHI of 10,000 Raley’s Pharmacy Patients Due to Stolen Laptop
Raley’s Pharmacy is sending notifications to around 10,000 patients about the possible exposure of some of [...]
MHSS Business Associate Improperly Retained PHI of 10,400 Patients
The Missouri Department of Health and Senior Services (MHSS) is informing 10,400 patients about a recently [...]
OCR Campaign to Boost Understanding of Civil Rights Protections for Patients Undergoing Opioid Use Disorder Treatment
On October 26, 2017, U.S. President Donald Trump declared that the opioid crisis in the United States was a [...]
Ransomware Attack on Sioux City Eye Clinic Potentially Exposed the PHI of 40,000 Patients
The Jones Eye Clinic and CJ Elmwood Partners, L.P, located in Sioux City, IA, have discovered the protected [...]
MediaPRO Study Shows 75% of Employees Have Poor Security Awareness
For three years now, MediaPRO, the security awareness training firm, has conducted a yearly study to assess [...]
Catawba Valley Medical Center and Byram Healthcare Breaches Impact Over 20,000 Patients
Catawba Valley Medical Center (CVMC) located in Hickory, NC, found out on August 13, 2018 that an [...]
FirstCare Health Plans Informs 8,000+ Members of Accidental PHI Disclosure
FirstCare Health Plans in Texas is informing over 8,000 plan members about the impermissible disclosure of [...]
Healthcare Data Breach Report for September 2018
September saw 25 healthcare data breaches of more than 500 records reported to the Department of Health and [...]
Employees Retirement System of Texas Data Breach Affects Up to 1.25 Million Individuals
The Employees Retirement System of Texas (ERS) has discovered a problem with its ERS OnLine portal. When some [...]
16,000 National Ambulatory Hernia Institute Patients Impacted by Ransomware Attack
California’s National Ambulatory Hernia Institute experienced a ransomware attack on September 13, 2018 [...]
Mobile Data Security and HIPAA Compliance
Healthcare providers and HIPAA-covered entities have been caught up in the mobile technology movement. Many [...]
FDA-DHS Collaborate to Medical Device Cybersecurity
A memorandum of agreement has been announced by the U.S. Food and Drug Administration (FDA) and the [...]
HIPAA Risk Analysis Guidance and Tools
The HIPAA risk analysis is a fundamental component of HIPAA compliance, but a lot of healthcare agencies and [...]
Most Common Phishing Emails Used by Cybercriminals in 2018
The most common types of phishing emails that cybercriminals send to healthcare organizations have been [...]
FDA Issues Alert Concerning Vulnerabilities in Medtronic Implantable Cardiac Device Programmers
The U.S. Food and Drug Administration (FDA) has issued an alert after it confirmed that certain Medtronic [...]
$640,000 Paid by Aetna to Settle HIPAA Violation Case with State Attorneys General
Two mailing errors in 2017 resulted in the impermissible disclosure of Aetna plan members’ protected [...]
Biomarin Pharmaceutical and Envision Healthcare Corporation Report Email-Related Breaches
Biomarin Pharmaceutical and Envision Healthcare Corporation have both recently announced that they have [...]
Changes in HIPAA Regulations and Enforcement in 2018
What changes in HIPAA regulations could be expected in 2018? Are there new HIPAA regulations expected to be [...]
Limited Waiver of HIPAA Penalties in Florida and Georgia in Aftermath of Hurricane Michael
Alex Azar, secretary of the Department of Health and Human Services (HHS) has waived HIPAA sanctions and [...]
PHI of 21,000 Patients of Minnesota DHS Potentially Compromised
Two recent phishing attacks on the Minnesota Department of Human Services (DHS) have resulted in a potential [...]
Vulnerabilities Found in Carestream Vue RIS, PeerVue Web Server and Siemens Healthcare Products
Five advisories have been issued by the Department of Homeland Security’s Industrial Control Systems Cyber [...]
Round Up of Recent Healthcare Data Breaches
Here’s a summary of the healthcare data breaches reported to OCR by healthcare providers and business [...]
HSCC to Issue Cybersecurity Best Practices for Medical Device Manufacturers and Healthcare Organizations
The Healthcare & Public Health Sector Coordinating Council (HSCC) will soon release voluntary [...]
Phishing Attack on Gold Coast Health Plan: PHI of 37,000 Members Potentially Compromised
Gold Coast Health Plan based in Camarillo, CA is alerting 37,000 plan members that hackers have potentially [...]
What Does PHI Stand For?
The acronym PHI is generally used in association with health information, but what does PHI stand for? What [...]
Can A Patient File A Lawsuit for A HIPAA Violation?
Is it possible for a patient to file a lawsuit for a HIPAA violation? There is no private cause of action in [...]
KHOU Employee Found Abandoned Paper Records Containing PHI in Houston Street
An employee of KHOU 11, a CBS-affiliated TV station, discovered abandoned paperwork that contained the [...]
Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook Issued by FDA
On October 1, 2018, the U.S. Food and Drug Administration released a Medical Device Cybersecurity Regional [...]
Healthcare Industry is More Susceptible to Phishing Attacks Than Other Industries
The healthcare sector is frequently attacked by phishers seeking access to healthcare information located in [...]
NIST’s New Guidance Document on Managing IoT Cybersecurity and Privacy
The National Institute of Standards and Technology (NIST) has released a draft of a guidance document that [...]
Three Legislation Changes on HIPAA Regulations in 2018 Under Consideration by OCR
Because of the policy of two out for every new regulation, it is likely that there will be few new HIPAA [...]
Phishing Attack on Aspire Health Resulted in PHI Theft
Aspire Health is a Nashville, TN in-home services provider for patients diagnosed with critical illnesses. [...]
Gynecologist Lost Her License But Did Not Get Jail Time and Fine for Criminal HIPAA Violation
In April 2018, 65-year old former Massachusetts gynecologist Rita Luthra was found guilty of a criminal [...]
Ex-Employee of Brooklyn’s Kings County Hospital Accused of Stealing and Selling Patients’ PHI
An employee of the emergency unit in Brooklyn’s Kings County Hospital has been charged with stealing [...]
Rising Incidences of HIPAA Violations on Social Media
Posting protected health information (PHI) on social media sites, including closed Facebook groups, violates [...]
How is the HITECH Act Related to HIPAA and Electronic Health and Medical Records?
The Health Insurance Portability and Accountability Act (HIPAA) was enacted in August 1996. It was updated in [...]
PHI of 17,000 Independence Blue Cross Members Was Exposed Online
Independence Blue Cross in Philadelphia has notified 17,000 of its plan members that their protected health [...]
California Legislature Approves California Consumer Privacy Act Changes
In June 2018, the California Consumer Privacy Act (CCPA) was approved by the California legislature. The Act [...]
FDA to Improve Reviews of Medical Device Cybersecurity
The Department of Health and Human Services’ Office of Inspector General (OIG) has issued a report [...]
CMS Investigates Fairview Southdale Hospital Patient Privacy Violation
The HHS’ Centers for Medicare and Medicaid Services (CMS) has investigated Fairview Southdale Hospital in [...]
Email-Related Breaches Reported by Hopebridge and United Methodist Homes
Hopebridge, a healthcare organization that operates a network of 28 autism treatment centers across the [...]
Texas Nurse Fired for Sharing PHI on Social Media
A nurse employed at Texas Children’s Hospital has lost her job as a result of sharing protected health [...]
What is Regarded as Protected Health Information According to HIPAA?
Protected Health Information according to HIPAA is individually identifiable health information collected, [...]
OCR Pubishes Guidance on Patient Data Sharing During a Public Health Emergency
Following President Trump’s declaration of a public health emergency in Virginia due to Hurricane [...]
Acadiana Computer Systems Phishing Attack Impacts 31,000 Individuals
Lafayette, Louisiana-based Acadiana Computer Services Inc., provides software and business solutions to the [...]
New Privacy Framework To Protect the Privacy of Workers and Customers
The National Institute of Standards and Technology (NIST) developed a Cybersecurity Framework in 2014 to [...]
Healthcare Data Breach Report for August 2018
In August, 28 healthcare data breaches were reported to the HHS’ Office for Civil Rights which represents a [...]
Over 21,000 Patients’ PHI Potentially Exposed Due to Reliable Respiratory Phishing Attack
Reliable Respiratory, a respiratory care provider located in Norwood, MA, has experienced a phishing attack [...]
New Mexico Hospital Health Records Found Scattered in the Street
The New Mexico Department of Health is conducting an investigation into how the confidential medical files of [...]
OCR Reminds Healthcare Organizations to Secure Electronic Media and Devices With ePHI
The Department of Health and Human Services’ Office for Civil Rights has reminded HIPAA-covered entities of [...]
Two-Thirds of UK Companies Do Not Have Insurance for Data Breaches
A recent report from NTT Security has revealed 66% of UK senior executives believe their company is not fully [...]
Nine Vulnerabilities Identified in Philips E-Alert Units
The Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) [...]
HIPAA Violation Cases: 2013 – 2017
This page contains a summary of HIPAA violation cases between 2013 and 2017 which led to civil monetary [...]
Guidance on Securing Wireless Infusion Pumps for Healthcare Delivery Organizations
The final version of the NIST Cybersecurity Practice Guide for Securing Wireless Infusion Pumps in Healthcare [...]
When is a HIPAA Release Form Necessary?
A HIPAA release form signed by the patient ought to be acquired prior to sharing that individual’s [...]
1,790 Patients Impacted by Phishing Attack on Drug and Alcohol Treatment Center in Los Angeles
Authentic Recovery Center, a drug and alcohol treatment center based in West Los Angeles, recently [...]
PHI of 19,570 Missouri Care Members Exposed Due to Mailing Error
An error in a Missouri Care mailing reminding parents to book well-child appointments has resulted in the [...]
BD Announces Critical Vulnerability Found in Alaris Plus Medical Syringe Pumps
Certain BD Alaris Plus medical syringe pumps have been found to contain a critical remotely exploitable [...]
McAlester Hospital Sued Over Impermissible Disclosure of PHI and HIPAA Violation
Dennis and Wayne Russell’s adopted two-year old son Keon died in a tragic swimming pool [...]
Healthcare Data Breach Report for July 2018
July 2018 is by far the worst month in 2018 with respect to healthcare data breaches. There were 33 [...]
Vulnerabilities Found in Philips IntelliVue Information Center iX and PageWriter Cardiographs
This week, the Industrial Control Systems Cyber Emergency Team (ICS-CERT) has issued two advisories about [...]
70% of Healthcare Companies Do Not Have Cybersecurity Insurance
Ovum conducted a survey recently on behalf of analytics firm FICO, which revealed there has been a major [...]
Survey Reveals Insufficient Anti-Phishing Controls in Place in U.S. Businesses
Phishing is currently the top cyber threat encountered by companies; however, regardless of a high [...]
PHI of 4,000 Patients of Colorado Dermatology Potentially Accessed
Central Colorado Dermatology (CCD) has informed more than 4,000 patients that hackers have potentially [...]
Legacy Health Phishing Attack Exposed 38,000 Patients’ PHI
Legacy Health has discovered an unauthorized individual has accessed its email system and potentially viewed [...]
9,350 Patients of Gordon Schanzlin New Vision Institute Warned About Data Breach
The Gordon Schanzlin New Vision Institute located in La Jolla, CA, has informed thousands of patients that [...]
Anthem’s $115 Million Data Breach Settlement Finally Approved
Anthem Inc. proposed a $115 million settlement in 2017 to resolve the class action lawsuits filed by the [...]
InterAct of Michigan Email Account Compromised Exposing 1,290 Patients’ PHI
The mental health and substance abuse treatment provider InterAct of Michigan has announced that [...]
Adams County Government Data Breach Impacts 258,000 People
A data security breach has occurred in Adams County, Wisconsin where the personal identification information, [...]
Augusta University Health Phishing Attacks Affected 417,000 People
Augusta University Health has announced it has experienced a data breach that has affected approximately [...]
Vulnerabilities in Philips IntelliSpace Cardiovascular Products Discovered
ICS-CERT has issued a warning regarding two vulnerabilities that have been discovered in Philips IntelliSpace [...]
Serious Vulnerabilities Discovered in Maryland’s Medicaid Management Information System
The Department of Health and Human Services’ Office of Inspector General (OIG) has released the results of [...]
Flaws in Patient Monitors Could Allow Hackers to Alter Vital Signs Data
Douglas McKee, a security researcher at McAfee, discovered a flaw in the communications protocol used to send [...]
Vulnerabilities in Fax Machines May Allow Network Access and Exfiltration of Sensitive Data
Healthcare companies still extensively use faxes for communication and in some hospitals, as much as 75% of [...]
Did the Oklahoma Department of Veteran Affairs Violate HIPAA Rules?
Three Democrat lawmakers have accused the Oklahoma Department of Veteran Affairs of violating Health [...]
New Phishing Websites Detections Rose By 46 Percent in Q1, 2018
The Anti-Phishing Working Group has published its Q1, 2018 Phishing Activity Trends Report. The report [...]
13,034 Patients Affected by MedSpring Urgent Care Breach
MedSpring Urgent Care, a network of emergency care clinics located in Austin, Atlanta, Chicago, Houston, Fort [...]
Further Vulnerabilities Identified in Medtronic MyCareLink Patient Monitors
An advisory has been issued by ICS-CERT regarding vulnerabilities found in MiniMed 508 Insulin Pumps and [...]
SamSam Ransomware Attack on Atlanta Likely to Cost $17 Million to Resolve
The SamSam ransomware attack on Atlanta City was expected to cost around $6 million to resolve; however a [...]
More Than 3.14 Million Healthcare Records Were Exposed in Q2, 2018
Protenus has released its Q2 2018 Breach Barometer Report – A summary and analysis of healthcare data [...]
Over 20 Serious Vulnerabilities Found in OpenEMR Platform
OpenEMR is a free, open-source electronic health record (EHR) management system that is used by a large [...]
PHI of 300,000 SSM Health Patients Exposed
Approximately 300,000 patients of SSM Health St. Mary’s Hospital in Jefferson City, Missouri have been [...]
OCR Reminds Healthcare Companies the Proper Disposal of Electronic Devices and Media
The Department of Health and Human Services’ Office for Civil Rights, in the July edition of its [...]
Hacktivist Convicted for DDoS Attack Facing 15 Years in Jail
The hacktivist, Martin Gottesfeld, 32, who was responsible for the Distributed Denial of Service (DDoS) [...]
Email Account Compromises Leading Cause of Q2 2018 Data Breaches
In the past year, email account compromises have been steadily increasing according to the July edition of [...]
New Guide for Securing Electronic Health Records on Mobile Devices Released by NIST/NCCoE
Physical, technical, and administrative controls can be implemented to secure ePHI on servers and desktop [...]
Four Healthcare Data Breaches Exposed the PHI of 9,400 Patients
This is a summary of data breaches that have recently to the Department of Health and Human Services’ [...]
UnityPoint Health Phishing Attack Affects 1.4 Million Patients
A phishing attack on UnityPoint Health has allowed hackers to gain access to the protected health information [...]
Consumers are Less Concerned About Breaches of Health Data Than Financial Data
The healthcare marketing agency SCOUT recently conducted a survey that revealed consumers are less concerned [...]
19,000 Patients of Orlando Orthopaedic Center Affected by Transcription Service Provider Breach
The protected health information (PHI) of over 19,000 patients was exposed due to an error by a transcription [...]
HHS to Release Information for the Proposed Changes on Federal Health Privacy Rules
Alex Azar, Secretary of the Department of Health and Human Services (HHS), explained in an address at The [...]
Confluence Health Discovers Phishing Attack Resulted in PHI Exposure
A data breach has been reported by Confluence Health, a non-profit health system managing Wenatchee Valley [...]
17,000 Patients’ PHI Exposed in Oregon and Massachusetts
The medical records of more than 17,000 patients have been exposed in two data breaches in Oregon and [...]
US-CERT Warns About Increasing ERP System Attacks
The United States Computer Emergency Readiness Team (US-CERT) has warned companies abut the growing risk of [...]
$150,000 Settlement Proposed by Flowers Hospital for 2014 Data Breach
A class action lawsuit filed in the aftermath of a data breach at Flowers Hospital in Dothan, Alabama in 2014 [...]
More than 105,000 Individuals Affected by Healthcare Phishing Attack
Boys Town National Research Hospital (Boys Town) in Omaha, NE has discovered that an employee was fooled by a [...]
New Massachusetts Bill Proposes 18 Months Complimentary Credit Monitoring Services for Data Breach Victims
A new bill has been proposed in the state of Massachusetts that aims to enhance protections for customers [...]
Malware and Ransomware Attack on Blue Springs Family Care Affects Almost 45,000 Patients
Blue Springs Family Care in Missouri was attacked with ransomware resulting in the encryption of [...]
New Guidance on Using EHR Data in Clinical Research Issued By the U.S. FDA
The U.S. Food and Drug Administration (FDA) has introduced new guidance about the usage of EHR data in [...]
3,775 Patients Informed of Unauthorized Access to a New York Physician’s Computer
Ruben U. Carvajal, MD, a doctor in New York, has started informing his patients that unauthorized individuals [...]
M.M. Ewing Continuing Care Center Employees Fired Over Snapchat Photo Sharing
Thompson Health’s M.M. Ewing Continuing Care Center, a nursing home in Canandaigua, NY, has discovered that [...]
Healthcare Data Breach Report for June 2018
Reported healthcare data breaches in June 2018 increased by 13.8% month-over-month although there were 42.48% [...]
44,600 Patients Affected by Golden Heart Administrative Professionals Ransomware Attack
Golden Heart Administrative Professionals based in Fairbanks, AK is a billing company that serves as a [...]
Phishing Attacks on Sunspire Health and UPMC Cole Compromised Several Employee Email Accounts
Two more healthcare companies have announced they have been victims of phishing attacks that have allowed [...]
LabCorp Attacked with Ransomware But PHI Access Still Not Confirmed
LabCorp, a major network of clinical laboratories in the U.S., experienced a cyberattack that potentially [...]
Phishing Attack on Alive Hospice Compromised Patients’ PHI
Alive Hospice in Tennessee has discovered the email accounts of two employees were compromised after the [...]
UMC Physicians and MSK Group Notify Patients of PHI Breach
The email account of a doctor at UMC Physicians in Texas was hacked, which resulted to the potential exposure [...]
Billings Clinic Employee’s Email Account Hacked Exposing 8,400 Patients’ PHI
The protected health information (PHI) of 8,400 patients contained in the email account of an employee of [...]
PHI of HIV Patients Exposed Because Metro Health Employee Made a Mistake
According to a report published in The Tennessean, a Metro Health employee made an error that resulted in the [...]
Factors that Increase the Cost of Resolving a Data Breach
The Ponemon Institute and IBM have explained several factors that impact the cost of data breaches in the [...]
Healthcare Data Breach Costs Now $408 Per Record
The Ponemon Institute has conducted its annual Cost of a Data Breach Study on behalf of IBM Security, which [...]
Lack of Authentication Controls on MedEvolve FTP Server Exposed Patients’ PHI
An FTP server used by MedEvolve, a provider of billing and medical record services to healthcare providers, [...]
Lawsuit Filed Against Children’s Mercy Hospital for Data Breach of 63,000 Patients’ PHI
A lawsuit has been filed against Children’s Mercy Hospital following a phishing attack that resulted in the [...]
Patient Privacy and Security Are Most Important to Consumers According to Aetna Survey
Health insurer Aetna conducted a survey about consumers’ attitudes toward healthcare, their associations [...]
Arkansas Children’s Hospital Employee Terminated For PHI Theft Involvement
Law enforcement is investigating a former employee of Arkansas Children’s Hospital for being involved in [...]
EHR Vendor’s Coding Error Caused the Impermissible Sharing of Patient Health Data
The UK’s National Health Service (NHS) has informed 150,000 patients that their health data was shared for [...]
Main Line Health Wins Age Discrimination Case Filed By Terminated Employee
In 2016, Main Line Health Inc. based in Radnor, PA dismissed an employee named Gloria Terrell for a violation [...]
Ransomware Attack on Cass Regional Medical Center Shuts Down EHR System
Cass Regional Medical Center in Harrisonville, MO has announced it suffered a ransomware attack at 11 am on [...]
API Vulnerabilities and USB-Related Cyberattacks Identified
HIMSS has published its June Healthcare and Cross-Sector Cybersecurity Report, in which warnings have been [...]
Manitowoc County Phishing Attack Resulted in PHI Theft
Manitowoc County in Wisconsin fell victim to a phishing attack resulting in the theft of protected health [...]
Copyright © 2007-2024 The HIPAA Guide Site Map Privacy Policy About The HIPAA Guide Terms and Conditions Accessibility Statement