HSA administrator discloses healthcare data breach

Palomar Health Medical Group suffers data breach

Palomar Health Medical Group (PHMG) alerted patients to a data breach that occurred from late April to early May 2024. The investigation is ongoing, and PHMG has not yet been able to determine the specific individuals and information involved in the breach.

PHMG is a multi-specialty, non-profit healthcare organization that serves patients in northern San Diego County. It also encompasses the formerly named Arch Health Medical Group and Graybill Medical Group.

PHMG discovered suspicious activity on certain systems within its network on May 5, 2024. PHMG immediately launched an investigation and determined that an unauthorized party gained access to certain files and potentially copied those files. Some of the files may be unrecoverable.

“However, PHMG is continuing its efforts to restore all files and identify the specific individuals and information that may have been impacted so it can provide individualized notice with additional information when its investigation is complete,” the notice stated.

At this stage of the investigation, PHMG’s assessment concluded that the breach may have involved names, Social Security numbers, medical treatment information, and financial information.  

DaVita discloses tracking pixel use

DaVita, which provides dialysis and integrated healthcare management services, informed users of its website health portal and Care Connect mobile application of its use of online tracking technologies.

DaVita stated that these technologies may have transmitted personal information to certain third-party vendors when users accessed the health portal or mobile app. DaVita used these tools to understand how visitors interacted with its websites.

The information that was potentially sent to third parties included IP addresses, usernames, employment status, certain demographic information, and information showing how the users interacted with DaVita’s health portal or mobile app. First and last names were not included, unless they were part of a user’s username.

“We have conducted a voluntary internal investigation into the use of these online technologies and removed or disabled these technologies if we could not find a HIPAA-compliant service to provide them,” DaVita stated.

“In addition, DaVita has implemented new policies and additional training on the use of online tracking technologies to safeguard against recurrence of this type of incident.”

DaVita encouraged users to block or delete cookies to prevent the use of tracking tech. The company also encouraged users to use “incognito” mode and adjust privacy settings where available.