Cyberciminals Access PHI, Steal Gift Cards from Kentucky Health Plan

Kaiser Permanente Reports 8-Year Insider Breach

A former imaging technician in the radiology department of the Kaiser Foundation Health Plan of the Mid-Atlantic States improperly accessed the radiology records of about 2,756 patients without authorization over the course of eight years, Kaiser Permanente recently reported.

Discovered in March, Kaiser Permanente placed the employee on administrative leave during the course of the investigation. Officials determined the improper access first began in 2012, and the employee continued to access patient records throughout the impacted timeframe until the access was discovered.

The investigation did not find a legitimate reason for the employee to access the impacted patient records, as the access fell outside of the employee’s job function. Officials said they fired the employee due to the HIPAA violation. Kaiser Permanente did not find evidence the data was copied or used to commit fraud.

The healthcare sector is notorious for its insider breaches, where insider errors are frequently cited as the leading cause. For the first time, Verizon’s latest Data Breach Investigations Report (DBIR) found external threats outpaced insider incidents. Remediation of these breaches cost the healthcare and pharma sectors more than $10.81 annually.

Third-Party Vendor Breach Impacts St. Joseph Health System

Third-party vendor Central Files, tasked with providing secure record storage and disposal for a number of healthcare covered entities, was found to have improperly disposed of some patient files, including those from St. Joseph Health System in Indiana, a member of Trinity Health.

According to its notification, Central Files was hired to destroy certain records and securely store some patient records until they were transferred to a subsequent records company. Those records included both sensitive and legally protected information from St. Joseph patients, clients, and or employees.

However, beginning on April 1, certain South Bend organizations were alerted that some of the confidential documents entrusted to Central Files were improperly dumped in an unsecure location in-town “sometime before April 1, 2020 and several more times until May 15, 2020.”

An investigation was immediately launched to determine the reason for the mishandling, working closely with South Bend law enforcement. Officials said they determined the records were discovered at a dump site in “poor condition, showing signs of moisture damage, mold and rodent infestation, and damage from being mixed with trash and other debris.”

“Trained safety personnel determined that further inspection of most of these records to identify individuals whose information was included in the documents would be extremely hazardous and instead recommended secure destruction as soon as possible,” officials explained.

The records able to be safely salvaged were retained, while St. Joseph engaged with a more appropriate document destruction vendor. The remaining records were securely removed from the site on May 20 and are currently being destroyed.

Many of the impacted records are more than a few decades old, likely containing outdated information. The compromised data included paper medical records and billing statements, which held patient names, contact information, dates of birth, Social Security numbers, insurance information, and other medical data.

The compromised records included Saint Joseph Health System from 1999 to 2013; Allied Physicians of Michiana from 1995 to 2007; New Avenues from June 2004 to December 2015; South Bend Medical Foundation from 2009 to 2015; Goshen Emergency Physicians and Elkhart Emergency Physicians from 2002 to 2010, Michiana Hematology Oncology from 2002 to 2004; and Cardiology Associates from March 1, 2007 to November 30, 2013.

Beacon Health System acquired CAI and its records in December 2013. Notably, it appears Central Files, Inc. is now permanently closed.