Data Breaches

Deadline to Report PHI Breaches Impacting Less Than 500 People Nears

by Jill McKeon

Under the HIPAA Breach Notification Rule, covered entities must report all protected health information (PHI) breaches to HHS. If the breach impacted more than 500 individuals, covered entities must...

Malware, Employee Email Breaches Result in PHI Exposure

by Jill McKeon

One look at the Office for Civil Rights (OCR) data breach portal shows that hospitals, nonprofits, and small community health centers continue to face healthcare data breaches. Hundreds of thousands...

CaptureRx to Consider Filing For Bankruptcy if $4.75M Settlement Not Approved

by Jill McKeon

CaptureRx CEO Chris Hotchkiss said the company would “strongly consider” filing for bankruptcy if a $4.75 million settlement to resolve multiple class-action lawsuits resulting from a 2021...

Illinois Hospital, FQHC Suffer Healthcare Data Breaches, PHI Exposure

by Jill McKeon

This week, two Illinois healthcare organizations began notifying patients of separate healthcare data breaches that caused protected health information (PHI) exposure. South Shore Hospital in Chicago...

Ransomware Demands, Data Leaks Skyrocketed Last Year

by Jill McKeon

In its annual threat report, CrowdStrike observed an 82 percent increase in data leaks resulting from ransomware in 2021. CrowdStrike researchers tracked more than 50 targeted ransomware events per...

Inmediata Health Reaches $1.13M Settlement After 2019 Data Breach

by Jill McKeon

Stemming from a 2019 data breach that impacted nearly 1.6 million patients, Puerto Rico-based Inmediata Health Group reached a $1.13 million settlement to resolve a class-action lawsuit. The lawsuit...

Lengthy Healthcare Cyberattack Recovery Disrupts MD Department of Health

by Jill McKeon

The road to healthcare cyberattack recovery is long for the Maryland Department of Health (MDH) as it enters month three of restoring business operations. Meanwhile, Taylor Regional Hospital (TRH) in...

Judge Proposes Dismissal of Practicefirst Data Breach Lawsuit

by Jill McKeon

A judge of the US District Court for the Western District of New York recommended the dismissal of a class-action lawsuit against medical management company Practicefirst, citing insufficient evidence...

Third-Party Data Breaches, Unauthorized Email Access Cause PHI Exposure

by Jill McKeon

Third-party data breaches, unauthorized email access, and cyberattacks aimed at small outpatient facilities continue to impact the healthcare sector. Threat actors are increasingly leveraging...

KY Hospital Systems Still Down 1 Week After Cybersecurity Incident

by Jill McKeon

Systems remain down at Taylor Regional Hospital (TRH) in Campbellsville, Kentucky more than a week after a cybersecurity incident. The hospital has not confirmed whether the incident was a...

GAO Seeks Feedback on Healthcare Data Breach Reporting

by Jill McKeon

UPDATE 2/7/22 - GAO extended the survey deadline to February 11. The Government Accountability Office (GAO) is asking HIPAA-covered entities for feedback on the healthcare data breach reporting...

Cyberattacks Against Health Plans, Business Associates Increase

by Jill McKeon

Cyberattacks targeted at health plans and third-party business associates increased last year, while attacks against healthcare providers dipped slightly, a report by Critical...

Excellus, BCBSA Reach Settlement Following 2015 Data Breach

by Jill McKeon

Excellus Health Plan, Blue Cross Blue Shield Association, and affiliate companies reached a tentative settlement in a class-action lawsuit stemming from a 2015 cyberattack. The data breach impacted...

KY Hospital Systems Down During Cybersecurity Incident Investigation

by Jill McKeon

Healthcare organizations notified victims of data breaches resulting from cyberattacks, server misconfigurations, and burglaries this week. As a result, the protected health information (PHI) of many...

Memorial Health Faces Lawsuit After Hive Ransomware Cyberattack

by Jill McKeon

Ohio-based Memorial Health System (MHS) is now facing a lawsuit regarding an August 2021 cyberattack that was claimed by Hive ransomware group. The cyberattack impacted over 215,000 individuals and...

Outpatient Facilities Continue To Be Targeted In Healthcare Cyberattacks

by Jill McKeon

Outpatient facilities and business associates continue to be prime targets for healthcare cyberattacks. Large health systems tend to have more resources to combat cyberattacks, causing cybercriminals...

Accellion Settles Class-Action Lawsuit for $8.1M Following Data Breach

by Jill McKeon

Accellion reached an $8.1 million settlement to resolve a class-action lawsuit that resulted from a December 2020 data breach involving zero-day vulnerabilities in the company’s File Transfer...

Family Medicine Practice Notifies Patients of Data Breach 1 Year Later

by Jill McKeon

Entira Family Clinics, a family medicine practice based in Minnesota, sent data breach notification letters to impacted individuals via the Maine Attorney General’s Office on January 13, 2022....

BioPlus Specialty Pharmacy Faces Lawsuit Over Healthcare Data Breach

by Jill McKeon

Two patients are seeking class-action status in a lawsuit against BioPlus Specialty Pharmacy over its handling of an October 2021 data breach that impacted 350,000 individuals. Plaintiffs alleged that...