HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Compassion Care Hospice Hack Impacts 1,128 Patients

Compassionate Care Hospice Las Vegas (CCHLV) has discovered an unauthorized individual gained access to its network and server and potentially viewed 1,128 patients’ protected health information.

On October 28, 2017, CCHLV discovered its network had been accessed by an unauthorized individual. Upon discovery of the breach, CCHLV hired third-party forensics experts to conduct a thorough investigation to determine the nature of the breach and to identify all patients who were potentially affected.

While the investigation confirmed access to data was possible, no evidence was uncovered to suggest any sensitive information was viewed or stolen by the attacker. However, it was not possible to rule out data access and theft with 100% certainty.

The types of information stored on the parts of the network that could have been accessed included names, dates of birth, addresses, Medicare numbers, medical treatment information, health insurance information, and archived electronic health records. Financial information was not stored on the part of the network compromised in the attack and remained secure at all times.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Once access to the network and server had been blocked, CCHLV conducted a comprehensive risk analysis to identify potential vulnerabilities to the confidentiality, integrity, and availability of PHI and has reviewed and revised network security policies accordingly. To ensure that any future cyberattacks are detected and mitigated rapidly, CCHLV has now implemented intrusion detection and monitoring systems.

CCHLV notified all affected individuals by mail on December 14, 2017 and reported the incident to the Department of Health and Human Services’ Office for Civil Rights. Upon discovery of the attack, law enforcement was notified and CCHLV is continuing to assist with the investigation.

Out of an abundance of caution, all patients impacted by the breach have been offered complimentary credit monitoring and identity theft restoration services for 12 months through Kroll.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.