HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

33,370 Mount Sinai Hospital Patients Impacted by AMCA Breach

Mount Sinai Hospital has discovered the protected health information (PHI) of 33,730 patients was compromised in the cyberattack on American Medical Collection Agency (AMCA).  The hospital is the 24th known victim of the massive AMCA breach, which has affected almost 25 million patients.

AMCA notified Mount Sinai Hospital on June 4, 2019 that an unauthorized individual had gained access to a web payment page, through which the PHI of its clients’ patients could be accessed. The webpage was compromised on August 1, 2018 and unauthorized access continued until March 30, 2019 when the breach was discovered and the web page was secured.

The breach only affected patients with outstanding medical bills that had been passed to AMCA for collection. The breach involved names, name of lab or medical service provider, dates of service, referring physician’s name, health insurance information, and other medical information related to the services provided by Mount Sinai.

Some patients also had financial information exposed. Those individuals were notified directly by AMCA and offered credit monitoring services. All other individuals are being notified by Mount Sinai Hospital.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Navicent Health Phishing Attack Impacts 1,400 Patients

Macon, GA-based Navicent Health is notifying approximately 1,400 patients that some of their protected health information was exposed in a phishing attack.

Navicent Health discovered an email account was compromised on June 24, 2019 as a result of an employee responding to a phishing email. Patient names, addresses, telephone numbers, medical information, insurance information, bank account information, Social Security numbers, and other personal information was potentially compromised.

This is not the first phishing attack to be reported by Navicent Health this year. In March, the healthcare provider announced a phishing incident had resulted in the exposure of 278,016 patients’ PHI. The breach occurred in July 2018, but it only became clear that PHI had been compromised on January 24, 2019.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.