HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Unsecured Database of Addiction Service Provider Potentially Contained Records of 145,000 Patients

A database containing highly sensitive information of patients who had previously sought treatment for addiction at rehabilitation centers has been discovered to be freely accessible over the internet.

The database contained approximately 4.91 million records which related to an estimated 145,000 patients of the Levittown, PA-based addiction rehabilitation service provider Steps to Recovery.

The unsecured database was discovered on March 24, 2019 by Justin Paine, Director of Trust and Safety at Cloudflare. Following the discovery, Paine notified Steps to Recovery and its hosting provider on March 24. No reply was received from Steps to Recovery, but its hosting company made contact and the database has now been secured and is no longer accessible online.

Paine had performed a search on the Shodan search engine to identify unsecured databases and devices. According to Paine, the ElasticSearch database contained two indexes which included more than 1.45 GB of data. The information could be accessed by anyone over the internet without the need for any authentication. The database was exposed online for more than two years, from the middle of 2016 to the end of 2018.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The types of information contained in the database included patients’ names, details of the treatments and services received at Steps to Recovery, the dates those services were provided, locations visited by patients, and billing information.

Paine was also able to obtain further information on patients with simple Google searches using information contained in the database. For a small sample of patients, Paine was able to discover information such as ages, dates of birth, email addresses, and possible contact telephone numbers.

The number of patients impacted by the breach has yet to be confirmed by Steps to Recovery and the incident is not yet listed on the Department of Health and Human Services’ Office for Civil Rights Breach portal. It is unclear if any other individuals found the database during the time it was accessible online.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.