Dental Health Management Solutions Notified Patients About Historic Data Breach
Cedar Park, TX-based Dental Health Management Solutions (DHMS), a provider of dental services to the government/military and private patients has recently announced – via its legal counsel – that the protected health information of certain patients was exposed in a 2021 hacking incident. In a February 2023 notification to the Maine Attorney General, DHMS said it detected a network intrusion on or around August 20, 2021, with the forensic investigation confirming its network was compromised on July 17, 2021.
A comprehensive review was conducted of all files that were potentially accessed or acquired in the attack and confirmed that 3,205 individuals have been affected. The types of information exposed varied from individual to individual and may have included names, addresses, medical information, health insurance information, Medicaid identification numbers, driver’s licenses, account and routing numbers, and Social Security numbers.
DHMS said it has changed passwords and implemented multifactor authentication and offered affected individuals complimentary credit monitoring and identity protection services. The notification letter lacks an explanation of why it took 18 months from the date of discovery of the breach for notification letters to be sent when the HIPAA breach notification rule requires notifications to be issued within 60 days or when the breach occurred.
Aloha Nursing Rehab Centre Breach Affects 20,000 Patients
Aloha Nursing Rehab Centre in Kaneohe, Hawaii, has recently reported a data breach to the HHS’ Office for Civil Rights that has affected 20,216 patients. According to the notification sent to the Maine Attorney General, its IT systems were accessed by an unauthorized individual on or around July 8, 2022. That individual accessed a limited number of electronic records in its systems.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Aloha Nursing Rehab Centre said the investigation and document review revealed on or around December 28, 2022, that the files accessed in the attack included patient information. The types of information involved included names, dates of birth, Social Security numbers, financial account information, driver’s license numbers, and state identification numbers. Affected individuals were notified by mail in February 2023 and were offered complimentary credit monitoring and identity theft protection services and will be protected by a $1,000,000 identity theft insurance policy.
The Chautauqua Center Identifies Limited Exposure of Patient Information
The Chautauqua Center (TCC) in Jamestown New York has recently announced that the protected health information of 747 individuals has been exposed in a data breach involving its business associate, WebPT, which provides electronic medical record services for Chautauqua Physical and Occupational Therapy.
The incident exposed the information of Chautauqua Physical and Occupational Therapy patients to other healthcare facilities during an upgrade to the EMR system on December 22, 2022. The referral report that was accessible to other healthcare clinics included names, case name/creation date, last seen/referral dates, insurance provider, treatment clinic, referring physician/physician group name, secondary insurance information, and total visit count for each case. WebPT has confirmed that clinical notes from the initial evaluation were not accessible.
Due to the limited nature of the data involved, and the fact that the information was only exposed to HIPAA-covered entities, the risks to patients are believed to be minimal; however, all individuals were notified about the exposure in January. Access to the report was disabled within 19 hours of discovery of the exposure, an analysis was performed to identify the cause of the breach, the staff was retrained, and statements were obtained from all affected clinics confirming that there had been no use or further disclosure of the report.
