1,745 Berkshire Medical Center Patients Impacted by Ambucor Health Solutions Breach
Berkshire Medical Center (BMC) in Pittsfield, Massachusetts has been informed that 1,745 patients of its cardiology department have been impacted by the security breach at Ambucor Health Solutions (AHS).
The Wilmington, DE-based business associate provides a remote monitoring service for BMC patients that have been fitted with cardiac devices. In July, AHS discovered an employee had emailed the protected health information of 41 patients to a personal email account prior to leaving the company.
However, an investigation into the incident revealed that more patient had been affected than was initially thought. The employee had also copied some protected health information onto two thumb drives. Those devices were recovered via law enforcement and were found to contain the sensitive data of thousands of patients.
AHS has now contacted all healthcare providers whose patients have been impacted by the breach and is notifying all affected individuals by mail, although it is the responsibility of each impacted healthcare provider to notify the Department of Health and Human Services’ Office for Civil Rights.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While the total number of individuals impacted by the security breach has not been released, the data of 2,500 patients of Greenville Health System in South Carolina, 775 patients of Wentworth-Douglass Hospital in Dover, New Hampshire, and 537 patients of WellSpan Cardiology (formerly Lebanon Cardiology Associates) have also been affected.
BMC patients have been told that their name, address, phone number, date of birth, patient ID number, ethnicity, testing data, Ambucor enrolment number, diagnosis, medications, medical device information, practice where they were being seen, and the names of the Ambucor technician that fitted the device and their physician were also present on one of the thumb drives.
Affected patients will be protected by a $1 million identity theft insurance policy and will be provided with credit monitoring and identity theft protection services for a period of one year without charge; although AHS does not believe any patient data have been used inappropriately. Additional security controls have now been implemented by AHS to prevent future breaches of patient health information.
