HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Healthcare Providers Affected by Email Account Breach at Payment Processing Vendor

Lafayette, LA-based Provider Health Services, Paragould-based Arkansas Methodist Medical Center, and Miami, FL-based lntelliRad Imaging have announced they have been affected by an email security breach at one of their business associates.

All three entities have a lockbox service with IBERIABANK to collect and process payments. IBERIABANK uses Technology Management Resources, Inc. (TMR) as a third‐party lockbox service provider for capturing and processing payment data for the lockbox. TMR discovered on July 3, 2020 that one of its employee’s email accounts had been accessed by an unauthorized individual, and that individual may have accessed or exfiltrated images containing protected health information.

TMR notified affected customers on August 21, 2020 and confirmed that the threat actor potentially viewed images of checks and other images that contained protected health information within the TMR’s iRemit application. The unauthorized access occurred between August 5, 2018 and May 31, 2020, with most of the activity occurring between February 2020 and May 2020.

Provider Health Services said in its substitute breach notice that the PHI potentially viewed was limited to names, addresses, Social Security numbers, and some medical information.

Get The Checklist

Free and Immediate Download
HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Arkansas Methodist Medical Center said in addition to above information, checking account numbers and routing numbers found on personal checks and information submitted with payments such as AMMC account numbers were also potentially compromised.

lntelliRad imaging reports that patient names, addresses, Social Security numbers, bank account and routing number, diagnosis and treatment information, test results, health insurance information, and other information related to patient medical care were also potentially compromised.

TMR has since taken several steps to prevent further breaches, including implementing additional firewall rules to carefully control access to the iRemit website, including restricting access from other countries

Arkansas Methodist Medical Center reported the breach as affecting 4,916 of its patients, 1,700 patients of Provider Health Services were affected, and lntelliRad imaging said 1,862 patients were affected.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.