The medical claims processor, CorrectCare Integrated Health, has recently notified its clients that the protected health information of some of their patients was accidentally exposed over the Internet and may have been accessed by unauthorized individuals. On July 6, 2022, CorrectCare discovered two file directories on its web server had been misconfigured and could be accessed over the Internet without requiring authentication.
The breach has affected patients treated by Mediko, Inc. in Virginia and Health Net Federal Services (HNFS) in California. Mediko is the largest provider of health care services to individuals in correctional facilities in Virginia, and HNFS is a business associate of the California Correctional Health Care Services (CCHCS)/ California Department of Corrections and Rehabilitation (CDCR). Around 80,000 individuals incarcerated in facilities operated by the Louisiana Department of Public Safety and Corrections are also known to have been affected.
CorrectCare said the web server was secured within 9 hours of the discovery of the misconfiguration. The forensic investigation confirmed the files were exposed from January 22, 2022. The exposed data related to individuals treated between January 1, 2012, and July 7, 2022.
The files in the exposed directories included names, dates of birth, inmate numbers, and limited health information, including diagnosis codes, CPT codes, treatment providers, dates of treatment, and, for some individuals, Social Security numbers.
Regions Hospital Reports Hackling Incident
Regions Hospital in St. Paul, MN, has recently confirmed that unauthorized individuals gained access to the protected health information of 978 patients. The attacker is believed to have accessed its secure network to steal payments from a health insurer, rather than to obtain patient information.
However, as part of that activity, a document on the network was opened that contained patient information, including first and last names and Social Security numbers. Affected individuals have been notified by mail and offered a 12-month membership to an identity theft protection service.
The post CorrectCare Integrated Health Data Breach Affects Thousands of Inmates appeared first on HIPAA Journal.