70,000 Valle del Sol Community Health Patients Affected by Cyberattack
Phoenix, AZ-based Valle del Sol Community Health has notified 70,268 patients that some of their protected health information has been exposed. Valle de Sol did not state in its notification letters when hackers gained access to its network, or for how long they had access, but did confirm that the unauthorized activity was detected on January 25, 2022.
Valle del Sol immediately took steps to secure its network and prevent further unauthorized access and engaged an independent cybersecurity firm to investigate the breach to determine if patient data had been accessed. Valle de Sol said the investigation indicated unauthorized individuals had access to files containing sensitive patient data and that patient information may have been acquired. A comprehensive review was conducted of all files that may have been accessed, which was completed on July 18, 2022.
The delay in sending notification letters was due to the length of the investigation, then having to verify up-to-date contact information. The verification of addresses concluded on September 1, 2022. Valle de Sol explained in its October 5, 2022, website notification that arrangements were then made to notify affected individuals. Steps have also been taken to strengthen security to prevent similar incidents in the future. Valle De Sol said it has not received any reports from patients to suggest any misuse of their data.
The exposed information included names, dates of birth, Social Security numbers, driver’s license numbers, clinical/diagnosis information, health insurance member ID numbers, medical record numbers, and Medicare or Medicaid numbers. Complimentary credit monitoring and identity theft protection services do not appear to have been offered to affected individuals.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Legacy Post Acute Care Announces Breach of Employee Email Accounts
Martinez, CA-based Legacy Post Acute Care has recently confirmed that multiple employee email accounts have been accessed by an unauthorized individual, who may have viewed or acquired the protected health information of certain patients.
Legacy Post Acute Care explained in its breach notification letters that an investigation was launched after suspicious activity was detected in its email environment. The investigation determined on September 12, 2022, that multiple employee email accounts were compromised between January 19, 2022, and March 3, 2022.
The review of emails and attachments confirmed the following types of information had been exposed: full names, along with one or more of the following data elements: Social Security number, date of birth, driver’s license number, state ID number, financial information, clinical/treatment Information, health insurance carrier, health insurance member ID/group number, medical provider name, medical record number, patient account number, and prescription information.
Legacy Post Acute Care said no evidence of misuse of patient data was uncovered; however, as a precaution against identity theft and fraud, affected individuals have been offered complimentary 12-month memberships to a credit monitoring and identity theft protection service. The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.
Berkshire Farm Center & Services for Youth Confirms Server and Email Account Breaches
Canaan, NY-based Berkshire Farm Center & Services for Youth has confirmed that an unauthorized third party gained access to certain servers and potentially viewed or obtained files containing protected health information. The breach was detected on July 15, 2022, its systems were immediately secured, and an investigation was launched to determine the nature and scope of the incident. The review of the affected files is ongoing.
Berkshire also announced that on or around August 9, 2022, it was determined that an employee email account was accessed by an unauthorized individual. It is unclear if these two incidents are related. Berkshire said the review of the email account confirmed it contained the names of 951 individuals and information related to the treatment provided and the network server contained the PHI of 23,058 individuals.
