Boston Children’s Health Physicians; XTIUM Settle Alleged HIPAA Violations for $2.7M
Boston Children’s Health Physicians (BCHP) and the managed IT service provider XTIUM have agreed to settle an investigation by the New York and Connecticut Attorneys General into a 2024 data breach that affected almost 890,000 individuals. The settlement includes a $4 million financial penalty, $2,700,000 of which will be paid to the states, and $1,300,000 has been suspended. New York will receive $2.1 million, and Connecticut will receive $540,000. The settlement agreement requires a series of measures to be implemented to improve cybersecurity. The suspended $1,300,000 will be payable ($1,040,000 to New York and $260,000 to Connecticut) if there is a failure to comply with the requirements of the settlement agreement.
The attorneys general launched an investigation in response to an August 2024 cybersecurity incident at XTIUM, a New York-based IT management company that provides network security services to BCHP and other companies. BCHP is a New York-based medical practice that provides medical services to young patients at 60 locations in New York and five in Connecticut.
At the time of the security incident, BCHP used two managed service providers for its IT functions, one of which involved the management and security of its active patient record system, which was unaffected. The second IT company, Axispoint Technology Solutions Group, Inc. (now XTIUM), was responsible for the management of other IT systems, but not security functions. The cybersecurity incident involved the IT systems managed by XTIUM.
In August 2024, XTIUM discovered that a threat actor had infiltrated its systems and those of 18 of its clients, including BCHP. XTIUM notified BCHP about the incident on September 6, 2024, and on September 7, 2024, BCHP performed a user password reset; however, it did not reset system or administrator passwords, and did not isolate the BCHP system from the internet. BCHP identified unauthorized activity within its own network on September 10, 2024, and isolated its systems from the internet. The incident was remediated, and systems were brought back online on September 13, 2024.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The forensic investigation determined that the threat actor exploited a remote access tool used by XTIUM and exfiltrated an unencrypted database containing patient billing records, which included the names of patients and guarantors, along with their contact information, dates of birth, Social Security numbers, driver’s license numbers, health insurance information, treatment information, and billing information. The data related to approximately 825,000 New York residents and 62,871 Connecticut residents, and included the Social Security numbers and/or driver’s license numbers of approximately 170,000 New York residents. The records of approximately 1,000 XTIUM employees were also compromised in the incident.
The investigation, led by the New York Attorney General, determined that XTIUM failed to implement reasonable safeguards to protect private information on its network. All recommended security settings for the remote access tool had not been implemented by XTIUM, and there was a lack of logging/monitoring for the remote access tool.
BCHP failed to enforce common standard security policies, and XTIUM did not request security policies; as such, it used a single shared administrative account with unrestricted access and unlimited privileges. Logging and monitoring were so poor that it was not possible to determine exactly how the attackers gained access, and it prevented meaningful analysis of the attack. After breaching BCHP systems, the attackers were able to compromise a further four unrestricted administrative accounts and gained access to BCHP’s entire system.
Security deficiencies included a lack of appropriate account permissions and restrictions, insufficient network segmentation, a failure to apply the principle of least privilege, and insufficient access controls, account monitoring, privileged account management, governance, and vendor assessments. Further, BCHP had undergone a third-party information security audit in 2023 that flagged a range of security issues; however, action was not taken to address the security gaps. For two years prior to the security incident, BCHP executives were aware that an archive containing over 1 million billing records was not encrypted. The unencrypted data was exfiltrated in the attack.
The New York Attorney General determined that there had been violations of the HIPAA Security Rule and New York Executive Law. In addition to the financial penalty, both entities are required to make improvements to their information security programs. Those measures include maintaining an accurate and up-to-date inventory of private information and ensuring the information is protected, implementing and maintaining reasonable authentication procedures for access to private information, implementing a logging and monitoring system, and enhancing threat response procedures.
“Institutions trusted with sensitive private health data have a critical responsibility to protect it from bad actors, said New York Attorney General Letitia James. “BCHP knew its data security features were inadequate but did not fix them, exposing the information of hundreds of thousands of New Yorkers to hackers. As a result of our investigation, we are holding BCHP accountable and ensuring they implement new measures to protect New Yorkers’ personal information.”
