Online Thieves Steal 1.3 Million Patient Records
The recent security breach at the Montana Department of Public Health and Human Services involving the ePHI of 1.3 million patients may not be the largest data theft to date, but it certainly ranks as one of the largest potential HIPAA security breaches reported to date, and is the biggest data breach caused by hackers at the time of writing.
Not only has the data been accessible in full by hackers, access to the data was possible for almost 12 months before the security breach was identified and access blocked. Officials have determined that the data was first accessed in July 2013 with a second attempt to access the data also occurring on May 22 this year. The identities of the intruders have so far not been established. The data has now been transferred to a new secure server.
Without a safeguard in place to alert the network operator to the unauthorized access in real-time, the cyberattack allowed the perpetrators to gain full unmonitored access and take their time exploring the data held on the server. In spite of the long window of opportunity, no evidence has been found to indicate that the ePHI was actually viewed by unauthorized individuals.
The Montana Department of Public Health and Human Services must now issue a notice – under the Breach Notification Rule – alerting each of the 1.3 million patients that their data has potentially been viewed. Patients should also be informed about the information the hackers potentially had access to, which is believed to include Social Security numbers, contact telephone numbers, home addresses, dates of examinations and tests and other medical data. In addition, some financial information was located on the server relating to payrolls, with employee bank account numbers also stored on the server.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
DPHHS director, Richard H. Opper, issued a statement and apologized to patients for the data breach and the stress that it is likely to cause. A number of services are being offered to patients to help them prevent identity theft, including the provision of a service to monitor credit lines. New strategies have been adopted to ensure data is better protected and the DPHHS is making an ongoing effort to ensure sensitive data is kept secure, although for reasons of security, the measures taken by DPHHS have not been divulged.
