Stolen iPad Leads to Potential PHI Exposure at Kaiser Permanente

Blue Shield of California Suffers Fourth-Party Vendor Breach

Bule Shield of California Promise Health Plan informed 1,506 individuals of a data breach that originated at OneTouchPoint (OTP), a subcontractor of Blue Shield vendor Matrix Medical Network.

On April 28, 2022, OTP discovered suspicious network activity and later confirmed that a ransomware attack had occurred. Blue Shield learned about the incident on May 20.

OTP immediately stopped the unauthorized access and further investigation revealed that the hacker potentially accessed PHI. The accessed data potentially included names, subscriber ID numbers, birth dates, sex, physician demographics, advance directives, diagnoses, medications, social history, vitals, immunizations, encounter data, allergies, assessment ID numbers, and assessment dates.

“Blue Shield takes this incident very seriously. We are committed to maintaining your privacy. OTP immediately terminated the unauthorized access, took mitigation actions, and began an investigation into the matter. OTP is also evaluating the need for additional steps and will continue to make security improvements,” the notice stated.

Clinivate Notifies 77K of EHR Data Breach

Clinivate, which provides an EHR solution for behavioral health agencies and schools, recently began notifying 77,652 individuals of a data breach that occurred in March 2022.

Clinivate discovered suspicious activity in its digital environment on March 23 and immediately launched an investigation. The investigation revealed that an unauthorized party had accessed certain systems and files containing personal information between March 12 and March 21.

The information potentially included names, medical record numbers, health plan beneficiary numbers, Social Security numbers, treatment information, diagnosis information, and other medical information.

“As soon as Clinivate discovered this unusual activity, it took steps to secure the environment, investigate, review the impacted data, and enhanced security measures to help prevent a similar incident from occurring in the future,” the notice to impacted individuals stated.

“Clinivate also notified the Federal Bureau of Investigation and will fully cooperate with any investigation.”