Getty Images

News

Nearly 63K Impacted by Healthcare Data Breach from Exploited Web Server

Sharp HealthCare in San Diego suffered a healthcare data breach after an unauthorized third-party gained access to the organization’s web server potentially exposing some PHI.

By
  • Sarai Rodriguez
Published: 10 Feb 2023

San Diego-based Sharp HealthCare notified 62,777 patients of a healthcare data breach that may have exposed their personal health information.

On January 12, 2023, Sharp HealthCare discovered that an unauthorized party may have accessed information through its web servers.

“We identified suspicious activity on a server that runs the Sharp.com website. We immediately initiated our incident response protocols, which included taking potentially impacted servers offline,” the notice explained. “We also began an investigation with the assistance of a forensic technology firm.”

Further investigation revealed that for a few hours on January 12, 2023, the unauthorized person comprised the web server and retrieved a file that contained protected health information (PHI).

The data involved varied from person to person but may have involved patient names, internal Sharp identification numbers and/or invoice numbers, payment amounts, and the names of the Sharp facilities receiving the payments.

Sharp HealthCare also assured patients that the health data breach did not involve any health record information or access to the FollowMyHealth patient portal.

Additionally, the accident impacted only those who paid a bill or invoice using the online bill payment service between Aug. 12, 2021, and Jan. 12, 2023.

Sharp HealthCare said it had not received any reports of information being misused as a direct result of the incident.

“We regret any concern or inconvenience this incident may cause and remain committed to protecting the confidentiality and security of our patients’ information,” the regional healthcare group stated. “We have enhanced the security tools on our website servers to help prevent this from happening in the future, and will continue to monitor our systems to proactively identify additional safeguards,”

Massachusetts Health Center Suffers Data Security Incident, 10K Impacted

Tallahassee Memorial DotHouse Health, a Massachusetts-based Joint Commission-accredited health center, posted a notice on its website alerting patients of a data security incident that 10,000 individuals.

The practice promptly launched an investigation with the assistance of third-party data review specialists after discovering suspicious activity on a limited portion of its network around late November 2022.

“DotHouse takes this event and information security very seriously,” the website notice stated. “Upon learning of this event, we immediately began an investigation and undertook remediation actions.”

DotHouse Health later determined that an authorized party downloaded some patient information between October 31, 2022, and November 27, 2022.

The files may have contained full names, addresses, dates of birth, medical record number, diagnoses/conditions, medications, other treatment information, and claims data.

For precautionary measures, DotHouse Health encourages impacted patients to watch for identity theft by “reviewing account statements, credit reports, and explanations of benefits for unusual activity and to detect errors.”

“As part of our ongoing commitment to the information security, we are enhancing our existing policies and procedures and implementing additional administrative and technical safeguards to further secure the information in our care,” the health center wrote. “DotHouse also reported the event to appropriate governmental agencies, including federal law enforcement and the U.S. Department of Health

Tallahassee Memorial HealthCare Makes Progress Following IT Security Issue

As previously reported, Florida-based Tallahassee Memorial HealthCare (TMH) began experiencing an IT security issue the night of February 2nd that led to EMS diversion and outpatient process cancellations.

According to a recent February 10, 2023 update, TMH is now “working toward bringing impacted systems back online. As is customary with events of this nature, it will take some time to return to normal operations. While we cannot share a definitive timeline, we are making significant progress and working nonstop to bring systems back online safely as soon as possible.”

On Wednesday, February 8, the organization began to increase patient volume but is still under downtime procedures.

“We continue to work with appropriate law enforcement and state and federal agencies to manage the investigation and recovery from this event,” Tallahassee Memorial HealthCare stated. “We will continue to provide updates, bearing in mind that, given the ongoing nature of the investigation and law enforcement’s involvement, we are limited in the amount of detail we can share.”

While the organization continues to recover from the event, more updates will be provided.

Next Steps

Dig Deeper on Cybersecurity strategies