Denton County in Texas has discovered a vulnerability in a third-party provider application used in connection with individuals’ personal health information has potentially been exploited by unauthorized individuals. The application was used at COVID-19 vaccination clinics in the County, and contained information such as names, dates of birth, email addresses, phone numbers, and COVID-19 vaccination information.
The vulnerability, discovered by Denton County officials on July 7, 2021, meant the information in the application database was accessible by anonymous users. When the flaw was discovered, the application was immediately shut down and an investigation was launched to determine the extent of the issue and whether any unauthorized individuals had exploited the flaw to gain access to sensitive data.
Denton County confirmed that an error had been made configuring the application which exposed data to unauthorized individuals. While no evidence was found to indicate any actual or attempted misuse of individuals’ protected health information, it was not possible to rule out unauthorized access to the underlying database.
A time consuming, comprehensive review was conducted to determine which individuals had been affected. Only the above information had been exposed. Sensitive data such as Social Security numbers, driver license numbers, and financial account information were not used in connection with the application.
Denton County, assisted by the third-party application provider, has now implemented additional safeguards to ensure the security of the application and the personal and protected health information of Couty residents.
The nature of the exposed data does not put individuals at a high risk of identity theft or fraud; however, the County has advised all affected individuals to remain vigilant and to review their account statements and credit reports for suspicious activity.
Initially, it appeared that around 1.2 million individuals had been affected, but a review confirmed many exposed files were duplicates. The breach has now been reported to the Department of Health and Human Services’ Office for Civil Rights as affecting 326,417 individuals.
The post TX: Denton County Discovers COVID-19 Application Leaked Data of 346,000 Individuals appeared first on HIPAA Journal.