Penobscot Community Health Center Victim of AMCA Breach
Another healthcare provider has discovered it has been affected by the security breach at American Medical Collection Agency (AMCA).
AMCA recently discovered an unauthorized individual had gained access to systems containing protected health information (PHI) provided by its clients. Its systems were first subjected to unauthorized access on August 1, 2018 and the breach persisted until March 30, 2019.
Penobscot Community Health Center (PCHC), a not for profit health center in Bangor, ME, contracted with AMCA for billing collection services. AMCA notified PCHC on May 15, 2019 that the PHI of approximately 13,000 of its patients had potentially been compromised.
In order to provide billing collection services, AMCA was provided with a limited amount of PHI. The only PHI provided to AMCA was for patients whose accounts had been sent to AMCA for debt collection and in each case the information disclosed was limited to the minimum necessary amount.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
During the 8 months that AMCA systems were subjected to unauthorized access the following types of information were potentially viewed or copied: Names, daters of birth, referring medical provider names, and other medical information related to the services received at PCHC. For a limited number of patients, credit card information may also have been compromised.
PCHC has terminated its business relationship with AMCA and is currently attempting to retrieve and secure all patient data provided to the firm.
PCHC joins Quest Diagnostics, BioReference Laboratories, and LabCorp as confirmed victims of the breach. Other healthcare organizations may also have been affected. To date, more than 20 million individuals are known to have been affected by the AMCA breach.
AMCA’s parent company has filed for bankruptcy and is attempting to liquidate assets to cover the cost of the breach response.
