8,300 Cerebral Palsy Research Foundation of Kansas Patients Informed of 10-Month Exposure of PHI
An oversight has caused a database used by Cerebral Palsy Research Foundation of Kansas (CPRF) to have its security protections removed for a period of 10 months, exposing the protected health information (PHI) of 8,300 patients.
The vulnerable demographic database was discovered on March 10, 2018 and was immediately secured. The investigation into the breach determined that while the database had been created on a secure subdomain in early 2000, when CPRF switched its servers in 2017 the database was not identified resulting in the accidental removal of security protections. During the time that the database was vulnerable it is possible that personal and health information was accessed by unauthorized individuals.
The breach was limited to personal information and personal health information relating to the type of disability suffered by patients. No financial information or donor information was exposed. Individuals affected by the breach had received services from CPRF between 2001 and 2010.
It is unclear whether any of the exposed information was accessed by unauthorized individuals during the time that the database was left unsecured. Out of an abundance of caution, CPRF is offering all affected individuals one year of credit monitoring and identity theft protection services free of charge.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
As part of its investigation and vulnerability remediation efforts, CPRF performed a complete audit of all domains, subdomains, and databases and discovered no further vulnerabilities existed. Data security policies have now been reinforced as have policies and procedures related to employee transitions to prevent future errors which could potentially lead to the exposure of PHI. CPRF has also contracted a third-party to perform regular vulnerability scans and penetration tests.
All affected individuals have been notified of the privacy breach by mail and a breach report has been submitted to the Department of Health and Human Services’ Office for Civil Rights.
