HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

1,745 Berkshire Medical Center Patients Impacted by Ambucor Health Solutions Breach

Berkshire Medical Center (BMC) in Pittsfield, Massachusetts has been informed that 1,745 patients of its cardiology department have been impacted by the security breach at Ambucor Health Solutions (AHS).

The Wilmington, DE-based business associate provides a remote monitoring service for BMC patients that have been fitted with cardiac devices. In July, AHS discovered an employee had emailed the protected health information of 41 patients to a personal email account prior to leaving the company.

However, an investigation into the incident revealed that more patient had been affected than was initially thought. The employee had also copied some protected health information onto two thumb drives. Those devices were recovered via law enforcement and were found to contain the sensitive data of thousands of patients.

AHS has now contacted all healthcare providers whose patients have been impacted by the breach and is notifying all affected individuals by mail, although it is the responsibility of each impacted healthcare provider to notify the Department of Health and Human Services’ Office for Civil Rights.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

While the total number of individuals impacted by the security breach has not been released, the data of 2,500 patients of Greenville Health System in South Carolina, 775 patients of Wentworth-Douglass Hospital in Dover, New Hampshire, and 537 patients of WellSpan Cardiology (formerly Lebanon Cardiology Associates) have also been affected.

BMC patients have been told that their name, address, phone number, date of birth, patient ID number, ethnicity, testing data, Ambucor enrolment number, diagnosis, medications, medical device information, practice where they were being seen, and the names of the Ambucor technician that fitted the device and their physician were also present on one of the thumb drives.

Affected patients will be protected by a $1 million identity theft insurance policy and will be provided with credit monitoring and identity theft protection services for a period of one year without charge; although AHS does not believe any patient data have been used inappropriately. Additional security controls have now been implemented by AHS to prevent future breaches of patient health information.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.