Orleans Medical Clinic located in southern Indiana reported that it was recently the victim of a hacking incident of its network server resulting in inappropriate access to the protected health information about 6,800 patients.
In a separate incident, Scan Health Plan, a health insurance company based in Long Beach, California, reported a data privacy incident on its website that resulted in unauthorized access to patient information.
In the Orleans Medical Clinic incident, a breach report filed with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) and publicly reported on the OCR’s breach portal indicated that 6,890 individuals were potentially affected by the server hacking incident. A notice posted on the medical practice’s website reported that on or about April 17, 2016, the clinic became aware of suspicious activity involving one of its computer servers. The clinic initiated an investigation and learned that its computer server that contained electronic health record data had been left unsecured after the server was upgraded.
“As a result, computer hackers gained access to the server over a period of time from April 5, 2016 until April 17, 2016. On July 21, 2016, we received confirmation of the individuals and information potentially affected by the breach,” according to a statement from the practice.
The practice stated that its investigation did not definitively conclude whether the hackers actually accessed or obtained a particular individual’s information. “It would have been possible for the hackers to access and obtain patient information about all of our current and former patients, including medical records and demographic information such as date of birth and social security number,” the practice stated.
Orleans Medical Clinic is offering all 6,890 patients one year of identity theft protection at no cost to patients through Equifax Personal Solutions.
Scan Health Plan posted a notice on its website stating that it is working with AllClear ID, an identity protection provider, to offer a year of identity protection services to plan members impacted by the data security incident.
On June 27, 2016, Scan Health Plan learned a person without authorization accessed contact sheets kept in a system used for sales purposes. “We immediately began an investigation and brought in outside experts. We determined the unauthorized access occurred between March and June 2016,” the health plan stated in it is notice. Scan Health also stated that there is no indication that the information in this system has been used fraudulently.
According to an article in the Long Beach Press Telegram, Scan Health Plan has about 170,000 members.
“The information on the contact sheets that were exposed included name, address, and phone number. For some people it also included date of birth and limited health notes, such as a doctor name, health condition, or medication name. For a small number of individuals it may have also included social security number,” the health plan stated.
