Baltimore-based healthcare provider LifeBridge Health has revealed, in a press release issued on May 16, that it had encountered a data breach. While the release made no reference to number of patients impacted at the time of it being issued, additional information has now been released.
LifeBridge Health discovered on March 18, 2018 that malware had been placed on a server that hosted the electronic medical record system utlized by LifeBridge Potomac Professionals and LifeBridge Health’s patient registration and billing systems.
The identification of malware led to an in depth investigation to determine when access to the server was first obtained. LifeBridge Health then hired a national computer forensics firm to help with the investigation with the firm finding that access to the server was first established 18 months earlier on September 27, 2016.
The range of information held on the server included patients’ names, dates of birth, addresses, diagnoses, medications prescribed, clinical and treatment details, insurance information and a small number of Social Security numbers.
LifeBridge Health has found nothing to suggest any patients’ protected health information has been used improperly, but as a precautionary measure, all patients whose Social Security numbers may have been accessed by the attackers will be given free credit monitoring and identity theft protection services for one year.
Additionally, all patients have been urged to carefully check their billing and explanation of benefits statements for any medical services charged but not sent. Patients have been asked to report any discrepancies to their insurance carriers as soon as they can.
LifeBridge Health has not released details of how access to the server was obtained, although its response to the incident provides some clues. In the official breach notice issued, the healthcare provider said it has “enhanced the complexity of its password requirements and the security of its system.”
The LifeBridge Health data breach is the second biggest healthcare data breach to be reported in 2017. The breach report sent to the Department of Health and Human Services’ Office for Civil Rights (OCR) shows 538,127 patients have potentially been affected.
While this data breach is not as big as the security breach reported by the California Department of Developmental Services (CDDS) in April, it is certainly more dangerous for the individuals affected.
The CDDS breach, which possibly affected 582,174 patients, was a burglary and it is not clear whether any PHI was actually viewed or acquired by unauthorized people. All electronic equipment stolen by the thieves was protected with encryption and no paperwork appeared to have been stolen.