12,500 Drug and Alcohol Abuse Program Patients Impacted by San Juan County Hack
Last month, San Juan County, NM., announced that a hacker had gained access to its computer systems and potentially viewed the highly confidential data of patients enrolled in its drug and alcohol abuse program.
Patients affected by the breach had previously been ordered by the courts to undergo treatment for drug and alcohol abuse after being caught using methamphetamine or driving while under the influence of alcohol.
Patients’ names and participation in the drug and alcohol program were potentially revealed to the hacker, along with their addresses, health assessment data, details of prescription medication, and the treatment methods they had been prescribed.
San Juan County was alerted to the intrusion within 30 minutes of access being gained, limiting the potential for data to be viewed or copied. Upon discovery of the hack, access to its system and data was terminated. During this short window of opportunity data may have been viewed or copied.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
San Juan County hired an external cybersecurity firm to conduct a thorough forensic investigation of the security breach. The investigation did not uncover any evidence to suggest that any patient health data was compromised, although the possibility that data were accessed and stolen could not be ruled out.
Consequently, patients have been placed at risk of suffering identity theft or fraud. To reduce the risk of financial harm, patients have been offered a year of credit monitoring services without charge. The county is protected by a $50,000 data breach insurance policy which officials believe will cover the costs associated with the breach.
The hack occurred on March 18, 2016. Initial reports of the data breach indicated as many as 12,000 patients had been affected. The San Juan County data breach has now appeared on the Department of Health and Human Services’ Office for Civil Rights breach portal. The breach report indicates 12,500 patients were affected.
