HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Penobscot Community Health Center Victim of AMCA Breach

Another healthcare provider has discovered it has been affected by the security breach at American Medical Collection Agency (AMCA).

AMCA recently discovered an unauthorized individual had gained access to systems containing protected health information (PHI) provided by its clients. Its systems were first subjected to unauthorized access on August 1, 2018 and the breach persisted until March 30, 2019.

Penobscot Community Health Center (PCHC), a not for profit health center in Bangor, ME, contracted with AMCA for billing collection services. AMCA notified PCHC on May 15, 2019 that the PHI of approximately 13,000 of its patients had potentially been compromised.

In order to provide billing collection services, AMCA was provided with a limited amount of PHI. The only PHI provided to AMCA was for patients whose accounts had been sent to AMCA for debt collection and in each case the information disclosed was limited to the minimum necessary amount.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

During the 8 months that AMCA systems were subjected to unauthorized access the following types of information were potentially viewed or copied: Names, daters of birth, referring medical provider names, and other medical information related to the services received at PCHC. For a limited number of patients, credit card information may also have been compromised.

PCHC has terminated its business relationship with AMCA and is currently attempting to retrieve and secure all patient data provided to the firm.

PCHC joins Quest Diagnostics, BioReference Laboratories, and LabCorp as confirmed victims of the breach. Other healthcare organizations may also have been affected. To date, more than 20 million individuals are known to have been affected by the AMCA breach.

AMCA’s parent company has filed for bankruptcy and is attempting to liquidate assets to cover the cost of the breach response.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.