Posted By HIPAA Journal on Jul 26, 2015

Share this article on:

Back in June we reported on a data breach that affected clients of NoMoreClipboard, although at the time few details were made available. This week, further information was released on the security breach.

The latest announcement does not add a great deal of new information. The data fields exposed in the breach have now been confirmed, and an updated list of NoMoreClipboard clients affected has also been announced.

Hackers Gained Access to Data for 19 Days – 239 Clients Affected

NoMoreClipboard runs MyKSHealth eRecord, which was infiltrated by hackers on May 7, 2015. Access to the records continued for 19 days until May 26, when the breach was discovered and access to the database was shut down.

The data understood to have been exposed in the incident includes patient names, addresses, email addresses, dates of birth, Social Security numbers, usernames, hashed passwords, security questions and answers, spouse names, in some cases, spouses’ dates of birth. Health information and health insurance details were also exposed.

Some healthcare providers have started issuing announcements alerting patients to the breach. Hutchinson Regional Medical Center in Kansas and Margaret Mary Community Hospital in Indiana have already announced that some of their patients have been affected, as has Concentra.

The total number of victims has now been confirmed as 3.9 million, according to the Department of Health and Human Services’ Office for Civil Rights website. Concentra also announced approximately 10,000 of its patients have been affected. Concentra is just one of many healthcare providers that Medical Informatics Engineering counts among its clients. Numerous other healthcare providers are expected to issue similar announcements in the coming days.

It has just taken some time for full details of the breach to be announced, as the investigation has taken some time. That investigation is still ongoing; however breach notification letters have now been sent to affected individuals. The first of the letters were sent to affected individuals on June 2, 2015. The majority of breach victims should now have received notification letters, provided they supplied a valid postal address.

Breach Notification Letters Have now Been Sent to Affected Individuals

In a press release issued on Thursday, NoMoreClipboard said “On June 2, 2015, we began contacting and mailing notice letters disclosing this incident to affected NoMoreClipboard and Medical Informatics Engineering clients.” It went on to say, “On July 17, 2015, we began mailing notice letters to affected individuals for whom we have a valid postal address through U.S. mail, and we expect those letters to be mailed on or before July 25, 2015.”

All individuals affected by the breach are being issued with 2 years of credit monitoring and protection services without charge. These services are being offered “out of an abundance of caution,” however victims should note that there is a considerable risk of the data being used to commit fraud. The data fields exposed would allow a criminal to defraud victims in a number of different ways. Identities could be stolen, false tax returns filed, credit obtained in victims’ names and bogus insurance claims could be filed. It is therefore imperative that victims sign up for the credit monitoring services being provided, place alerts with each of the credit monitoring agencies, and check Explanation of Benefits statements carefully for signs of fraudulent activity.

It has taken almost two months for breach notification letters to be issued; although this has happened within the timescale allowed by the Health Insurance Portability and Accountability Act (HIPAA). The data breach was highly sophisticated in nature. Because of the complexity of the attack, and the volume of clients affected, the breach response has taken some time to orchestrate.

The full list of affected clients has now been issued, which include the following 239 healthcare providers:

New Security Controls are Being Implemented to Prevent Future Data Breaches

The breach has highlighted a number of areas where security could be improved to reduce the risk of future attacks being successful. According to Medical Informatics Engineering’s Co-Founder and COO, Eric Jones, “We are continuing to take steps to remediate and enhance the security of our systems.”

He explained, “Remedial efforts include removing the capabilities used by the intruder to gain unauthorized access to the affected systems, enhancing and strengthening password rules and storage mechanisms, increased active monitoring of the affected systems, and intelligence exchange with law enforcement. We have also instituted a universal password reset.”

Post updated: August 4, 2015