Share this article on:
An oversight has caused a database used by Cerebral Palsy Research Foundation of Kansas (CPRF) to have its security protections removed for a period of 10 months, exposing the protected health information (PHI) of 8,300 patients.
The vulnerable demographic database was discovered on March 10, 2018 and was immediately secured. The investigation into the breach determined that while the database had been created on a secure subdomain in early 2000, when CPRF switched its servers in 2017 the database was not identified resulting in the accidental removal of security protections. During the time that the database was vulnerable it is possible that personal and health information was accessed by unauthorized individuals.
The breach was limited to personal information and personal health information relating to the type of disability suffered by patients. No financial information or donor information was exposed. Individuals affected by the breach had received services from CPRF between 2001 and 2010.
It is unclear whether any of the exposed information was accessed by unauthorized individuals during the time that the database was left unsecured. Out of an abundance of caution, CPRF is offering all affected individuals one year of credit monitoring and identity theft protection services free of charge.
As part of its investigation and vulnerability remediation efforts, CPRF performed a complete audit of all domains, subdomains, and databases and discovered no further vulnerabilities existed. Data security policies have now been reinforced as have policies and procedures related to employee transitions to prevent future errors which could potentially lead to the exposure of PHI. CPRF has also contracted a third-party to perform regular vulnerability scans and penetration tests.
All affected individuals have been notified of the privacy breach by mail and a breach report has been submitted to the Department of Health and Human Services’ Office for Civil Rights.