Monongalia Health Suffers Second Healthcare Data Breach

March 03, 2022 - West Virginia-based health system Monongalia Health began notifying patients of a healthcare data breach that resulted in unauthorized access to protected health information (PHI). Just a few months ago, Monongalia fell victim to a phishing attack that also exposed PHI.

Mon Health discovered the second data security incident on December 18, 2021, when it detected unusual network activity. After the discovery, Mon Health disabled a "significant portion" of its IT network and initiated downtime procedures.

The breach did not involve Mon Health's EHR systems. Still, it potentially exposed the names, addresses, Medicare claim numbers, Social Security numbers, birth dates, health insurance plan member ID numbers, dates of service, patient account numbers, medical information, and health plan enrollment status of some patients, providers, employees, and contractors.

"To help prevent something like this from happening again, Mon Health has implemented, and will continue to adopt, additional safeguards and technical security measures to further protect and monitor its systems," the notice stated.

After the last breach, which was discovered in July 2021, Mon Health also assured impacted individuals that it was "continuing to review and enhance its existing security protocols and practices, including the implementation of multi-factor authentication for remote access to its email system."

DC Health's COVID-19 Vaccine Record Portal Faces Security Incident

Washington DC's health department shut down its COVID-19 vaccine record portal one day after its launch after some residents reported receiving other people's vaccine records, NBC Washington reported.

DC Health launched the portal on February 14 for the purpose of giving residents easy and secure access to their COVID-19 vaccine records. Residents were asked to enter their name, phone number, and birth date to receive a link containing their vaccine records.

But approximately 30 people reported receiving someone else's records instead.

"I received a gentleman's vaccine card with a QR code and it was not my information. So, I panicked because I didn't want to have somebody else's health records," a DC resident told NBC Washington.

After receiving multiple reports, DC Health shut down the portal.

"DC Health is aware that a small number of residents have experienced issues while using the DVR system during a period of high utilization this afternoon," a spokesperson for the department said in a statement.

The portal is now back online.

Extend Fertility Ransomware Attack Impacts More Than 10K

New York-based Extend Fertility began notifying 10,373 individuals of a ransomware attack that impacted its servers containing protected health information (PHI). Extend Fertility discovered the attack on December 20, 2021, and later determined that the incident began on December 15.

The threat actor accessed the fertility clinic's system and "likely obtained some information," the notice stated. The exposed information potentially included clinical information, demographic information, and financial information, including medical history, lab test results, health insurance policy and group plan numbers, and other PHI.

Extend Fertility said it had no evidence that any information had been used to commit fraud.

"We take the responsibility to protect the security and privacy of the information in our care with the utmost seriousness, and we sincerely regret the concern and inconvenience caused by this event. In response to this incident, we are implementing additional safeguards to our existing cybersecurity infrastructure and enhancing its employee cybersecurity training," the notice said.

"Further, we are working with its external cybersecurity experts to improve our cybersecurity policies, procedures, and protocols to help minimize the likelihood of this type of incident occurring again."