Lafayette, LA-based Provider Health Services, Paragould-based Arkansas Methodist Medical Center, and Miami, FL-based lntelliRad Imaging have announced they have been affected by an email security breach at one of their business associates.
All three entities have a lockbox service with IBERIABANK to collect and process payments. IBERIABANk uses Technology Management Resources, Inc. (TMR) as a third‐party lockbox service provider for capturing and processing payment data for the lockbox. TMR discovered on July 3, 2020 that one of its employee’s email accounts had been accessed by an unauthorized individual, and that individual may have accessed or exfiltrated images containing protected health information.
TMR notified affected customers on August 21, 2020 and confirmed that the threat actor potentially viewed images of checks and other images that contained protected health information within the TMR’s iRemit application. The unauthorized access occurred between August 5, 2018 and May 31, 2020, with most of the activity occurring between February 2020 and May 2020.
Provider Health Services said in its substitute breach notice that the PHI potentially viewed was limited to names, addresses, Social Security numbers, and some medical information.
Arkansas Methodist Medical Center said in addition to above information, checking account numbers and routing numbers found on personal checks and information submitted with payments such as AMMC account numbers were also potentially compromised.
lntelliRad imaging reports that patient names, addresses, Social Security numbers, bank account and routing number, diagnosis and treatment information, test results, health insurance information, and other information related to patient medical care were also potentially compromised.
TMR has since taken several steps to prevent further breaches, including implementing additional firewall rules to carefully control access to the iRemit website, including restricting access from other countries
Arkansas Methodist Medical Center reported the breach as affecting 4,916 of its patients, 1,700 patients of Provider Health Services were affected, and lntelliRad imaging said 1,862 patients were affected.
The post Healthcare Providers Affected by Email Account Breach at Payment Processing Vendor appeared first on HIPAA Journal.