The U.S. Vision Inc. subsidiary, USV Optical Inc. has announced unauthorized individuals have gained access to certain servers and systems that contained patients’ protected health information. The unauthorized access was detected on May 12, 2021, with the subsequent forensic investigation confirming the hackers had access to its systems for almost a month from April 20, 2021 to May 17, 2021, when its systems were secured.
Third-party computer forensics specialists are continuing to investigate the breach to determine the full extent and scope of the intrusion but have concluded that unauthorized individuals potentially viewed and exfiltrated patient data in the attack.
It has been confirmed that the following types of employee and patient data have been exposed: Names, eyecare insurance information, and eyecare insurance application and/or claims information. A subset of individuals may also have had the following data exposed: Address, date of birth, and/or other individual identifiers. No reports have been received to date of any cases of attempted or actual misuse of personal and protected health information as a result of the security breach.
The data breach has been reported to the Department of Health and Human Services’ Office for Civil Rights as affecting 180,000 individuals. Notifications are being sent to those individuals along with advice on steps that can be taken by breach victims to protect their identities, should they deem those steps to be appropriate.
USV Optical said it worked diligently to investigate and respond to the incident is currently working to identify and notify potentially impacted individuals. A review is being conducted of policies related to data protection and these will be enhanced to better protect patient data.
This is the second major data breach to be reported by an eye care provider in the past few days. Simon Eye Management recently reported an email security breach in which the protected health information of 144,000 individuals was exposed.
The post U.S. Vision Subsidiary Reports Hacking Incident Affecting 180,000 Individuals appeared first on HIPAA Journal.