119 Pediatric Practices Affected by Breach at EHR Vendor – 2.2 Million Patients Affected

Connexin Software Inc., which provides electronic medical records and practice management software (Office Practicum) to pediatric physician practice groups has recently confirmed that it was the victim of a cyberattack in which an unauthorized third party gained access to its internal computer network.

While the electronic medical record system was not accessed in the attack, and none of its client databases, systems, or medical records were accessed, the threat actors did access parts of its network that contained the protected health information of patients of its clients. The substitute breach notice indicates 119 pediatric healthcare providers were affected by the breach.

Connexin Software reported the breach to the HHS’ Office for Civil Rights as affecting 2,216,365 million patients. At least one healthcare provider client has reported the breach (Forest Hill Pediatrics – 4,958 records), so the breach total may well be higher if other providers have also chosen to report the breach separately.

Connexin Software said a data anomaly was detected within its network on August 26, 2022, which prompted an immediate investigation into the suspicious activity. A third-party forensics company was engaged to assist with the investigation and determine the nature and scope of the incident. Connexin Software learned on September 13, 2022, that an unauthorized third party has accessed its network, which included an offline set of patient data that had been created for data conversion and troubleshooting. Some of that data was exfiltrated in the attack, although at the time of issuing notifications, no misuse of that data had been identified.

When the breach was detected, a password reset was performed for all corporate accounts. The offline data that was used for data conversion and troubleshooting has now been moved to a different part of the network that has greater security. Security and monitoring have also been stepped up to prevent similar breaches in the future.

Children’s protected health information is especially valuable to cybercriminals, as it can often be misused for long periods of time before that misuse is detected. Victims of this breach have been advised to closely monitor credit reports and statements from providers for signs of misuse. In cases where a child’s Social Security number was exposed or stolen, child identity monitoring services have been offered for 12 months.

Information compromised included patient names, guarantor names, parent/guardian names, addresses, email addresses, birth dates, Social Security Numbers, health insurance information, dates of service, location, services requested or procedures performed, diagnoses, prescription information, physician names, medical record numbers, and billing and claims information.

Practices confirmed as being affected by the breach are detailed in the table below.

The post 119 Pediatric Practices Affected by Breach at EHR Vendor – 2.2 Million Patients Affected appeared first on HIPAA Journal.