12,500 Drug and Alcohol Abuse Program Patients Impacted by San Juan County Hack

Last month, San Juan County, NM., announced that a hacker had gained access to its computer systems and potentially viewed the highly confidential data of patients enrolled in its drug and alcohol abuse program.

Patients affected by the breach had previously been ordered by the courts to undergo treatment for drug and alcohol abuse after being caught using methamphetamine or driving while under the influence of alcohol.

Patients’ names and participation in the drug and alcohol program were potentially revealed to the hacker, along with their addresses, health assessment data, details of prescription medication, and the treatment methods they had been prescribed.

San Juan County was alerted to the intrusion within 30 minutes of access being gained, limiting the potential for data to be viewed or copied. Upon discovery of the hack, access to its system and data was terminated. During this short window of opportunity data may have been viewed or copied.

San Juan County hired an external cybersecurity firm to conduct a thorough forensic investigation of the security breach. The investigation did not uncover any evidence to suggest that any patient health data was compromised, although the possibility that data were accessed and stolen could not be ruled out.

Consequently, patients have been placed at risk of suffering identity theft or fraud. To reduce the risk of financial harm, patients have been offered a year of credit monitoring services without charge. The county is protected by a $50,000 data breach insurance policy which officials believe will cover the costs associated with the breach.

The hack occurred on March 18, 2016. Initial reports of the data breach indicated as many as 12,000 patients had been affected. The San Juan County data breach has now appeared on the Department of Health and Human Services’ Office for Civil Rights breach portal. The breach report indicates 12,500 patients were affected.

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.