Alliance Health Reports 30-Month Health Data Exposure
Alliance Health has discovered one of its patient databases had been misconfigured and left accessible via the Internet, resulting in the protected health information of 40,000 patients being exposed for a period of 30 months.
A database configuration error was discovered on December 17, 2015., which had left it unsecured and potentially accessible by the public, although an investigation did not uncover any evidence to suggest that patient data were accessed during the time the database was unsecured.
Upon discovery of the error the database was taken offline and secured, and unauthorized access is no longer possible. The investigation revealed that patient data were accessible between July 2013 and December 17, 2015.
No Social Security numbers or financial data were stored in the database, although patient names, telephone numbers, addresses, and email addresses could potentially have been accessed. A limited amount of clinical information including the medications that had been prescribed to patients were also stored in the database. The only patients affected are those who submitted information online before July 2013.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
According to the substitute breach notice placed on the Alliance Health website, breach notification letters started to be sent to affected patients on February 15: 60 days after the discovery of the database error.
It is not clear why it took the entire 60-day time frame allowed under HIPAA rules for breach notification letters to be sent to affected patients. The HIPAA Breach Notification Rule requires covered entities to send notification letters to patients affected by a security incident within 60-days of the discovery of a potential breach of PHI. It can take time for an investigation to be completed, although covered entities should attempt to notify affected individuals without unnecessary delay.
After the discovery of the configuration error Alliance Health performed a full audit of all patient databases to ensure protected health information was secured and could only be accessed by authorized personnel. Enhanced security measures have also been implemented at Alliance Health to reduce the probability of similar security issues occurring in future.
