Austin Medical Center Discovers Patient Data Was Accessible Via Internet
An Austin, TX medical center has discovered patient data has been stolen and uploaded to the Internet and was accessible for 4 years. The information, which related to approximately 2,000 patients, could freely be found via search engines.
Victory Medical Center was alerted to the data leak on April 5, 2017 by a patient who had found his or her personal information online while browsing the Internet.
An investigation was launched by Victory Medical which revealed a paper based report containing patient information had been uploaded to Github by an unauthorized individual. The data was taken and uploaded without the knowledge or authorization by Victory Medical. The company says the breach was likely the work of a ‘lone bad actor’.
The date of the breach is not known, although it is likely the incident occurred on or after June 10, 2013 according to the substitute breach notice uploaded to the Victory Medical website. The report had been generated from Victory Medical’s secure patient record system, although it did not include any medical information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The types of information exposed and likely viewed by unauthorized individuals was restricted to patients’ names, phone numbers, addresses, email addresses, preferred language, race and ethnicity and internal medical account numbers. Victory Medical contacted Github and arranged for the information to be removed. The information was taken offline five days later.
Since only demographic information has been exposed, Victory Medical believes the risk of improper use of the information is low.
The breach investigation involved interviews with all members of staff who were working at or around the time of the suspected breach, although the person responsible for the breach could not be identified.
The breach has prompted a review of privacy practices, policies and security procedures that could potentially have contributed to the breach, although no systemic weaknesses have been identified. Physical security standards are also being reviewed at the organization’s offices and feasible changes will be implemented to improve security and prevent future breaches of PHI.
