HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Over 30 Healthcare Providers Affected by CIOX Health Data Breach

The health information management services provider CIOX Health has suffered a data breach that has affected at least 32 healthcare providers. In July 2021, CIOX Health discovered an unauthorized individual had gained access to the email of an employee in the customer service department. The email account was immediately secured, with the subsequent investigation confirming the email account had first been accessed by an unauthorized individual on June 24, 2021, and access remained possible until the security breach was detected on July 2, 2021.

The CIOX Health breach investigation confirmed that the incident was confined to a single employee email account, with the review of the contents of the email account determining on September 24, 2021, that it contained emails and attachments that included the protected health information of some of its healthcare provider clients such as names, dates of birth, provider names, dates of service, and the Social Security numbers, driver’s license numbers,  health insurance information, and/or treatment information of a very limited number of individuals.

The employee in question worked in customer service and, as such, serviced healthcare provider clients across the country with billing issues and helped with other customer service requests, hence a large number of affected clients. The employee did not, however, have access to the medical record systems of any of its healthcare provider clients.

CIOX Health said that during the time that the account was accessible it is possible that emails containing protected health information were accessed or copied, but no direct evidence of attempted or actual misuse of patient data has been uncovered. CIOX Health believes that the email account was compromised to send phishing emails from the company domain to individuals unrelated to CIOX Health.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

COX Health is encouraging all individuals affected by the breach to check their statements and explanation of benefits statements from their healthcare providers and insurers for any sign of unauthorized use of their information.

In response to the breach, CIOX Health will be implementing stronger email security measures and will provide the workforce with further security awareness training.

CIOX health started notifying affected healthcare provider clients about the breach on December 30, 2021. Healthcare providers known to have been affected by the email account breach at CIOX Health are listed below.

  • AdventHealth – Orlando
  • Alabama Orthopaedic Specialists
  • Baptist Memorial Health Care
  • Butler Health Systems
  • Cameron Memorial Community Hospital
  • Centra Health
  • Children’s Healthcare of Atlanta
  • Coastal Family Health Center
  • Copley Hospital
  • DeSoto Memorial Hospital Health System
  • EvergreenHealth
  • Hoag Health System
  • Hospital Sisters Health System
  • Huntsville Hospital Health System
  • Indiana University Health
  • McLeod Health System
  • MD Partners
  • Niagara Falls Memorial Medical Center Health System
  • Northern Light Mercy Hospital
  • Northwestern Medicine
  • Ohio State University Health System
  • OrthoConnecticut
  • Prisma Health – Greenville Health System
  • Prisma Health – Palmetto Health
  • Sarasota County Public Hospital District d/b/a Sarasota Memorial Health Care System
  • Trinity Health – Holy Cross Hospital
  • Trinity Health – Mount Carmel Health System
  • Trinity Health – Saint Alphonsus Health System
  • Trinity Health – St. Francis Medical Center
  • Trinity Health – St. Joseph Mercy Health System
  • Union Hospital Healthcare System
  • Women’s Health Specialist

The security breach has been reported to the HHS’ Office for Civil Rights by CIOX Health as affecting 12,493 individuals.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.