a cardiac monitoring firm is now notifying patients after a Google lookup on their call in January led them to an August, 2020 report on this site about a vendor’s leak. But why didn’t they live about it already from the vendor last year or from the notifications this site had sent them last year? in August, 2020, DataBreaches.net reported on a data leak discovered by a researcher. The leaky Amazon s3 bucket appeared to be storing more than 60,000 files related to patients having cardiac diagnostic monitoring and evaluation. The files included medical histories, findings, and insurance billing documentation requests. They came from numerous medical providers. The researcher shared the data with DataBreaches.net in an attempt to determine who owned the storehouse bucket. The files had some recurring names on them, but neither the researcher nor DataBreaches.net were ever able to conclusively regulate who owned the bucket, although it appeared to be either BioTel pump or HealthSplash/SplashRx. HealthSplash appeared to live involved in insurance billing somehow for BioTel Heart, but neither entity responded to multiple attempts by this site to tangency them to alert them to the fact that ePHI was exposed and possibly had been exposed since 2019. It was only with Amazon’s assistance that the researcher was able to get the bucketful secured. as is their policy, however, Amazon never told the researcher who their client was — only that they contacted them to secure the bucket. On august 9, the bucket was secured and DataBreaches.net reported on the leak shortly thereafter. But DataBreaches.net continued to try to tangency the entities to ask whether either was notifying regulators or patients. getting no answers and seeing no disclosures despite the fact that more than 3 months had passed since the bucket owner had been notified by amazon and the bucket had been secured, DataBreaches.net filed a watchdog complaint against both entities with OCR in November. On February 2, DataBreaches.net got a phone call from a lawyer for BioTel. He informed this site that they had just discovered this site’s August, 2020 describe about them having a leak and they were conducting an internal investigation to encounter out why they had known nix about it until they came across this site’s reporting. he wanted to know how this site had attempted to contact them, and this site wanted to know whether it was their bucket and why neither they nor HealthSplash/SplashRx had responded to multiple attempts to touch them. He never got backrest to this site, so DataBreaches.net has no idea what their internal investigation revealed. Yesterday, a template of a notification letter to BioTel’s patients was uploaded to the California Attorney General’s site (BioTel also does business as LifeWatch Services, Inc. and CardioNet LLC). A copy of the notification is embedded below. A few things jumped out at me: In its march 26 notification, BioTel described the incident as “recent.” This was not a “recent” incident. It began in 2019 and continued until August 9, 2020, as they notation in their letter. Maybe they meant to say that it was not a recent incident but they only discovered it recently? They say that they discovered it on January 28, 2021. Their “discovery” at the end of January is only because they didn’t read their email indorse in August of 2020 and thereafter when we repeatedly reached out to them. The notification makes no mention or admission of that. The fact that they say the “discovered” the vendor’s leak in January, 2021 seems to indicate that their vendor never informed them of the incident. If that’s true, it would appear to be a violation of HIPAA, and it is no surprise to record in the notification that BioTel has terminated its relationship with the vendor. The notification never names the vendor. But what did BioTel find out from the vendor other than appointment of exposure, types of data, and the identities of the patients affected? Did the vendor have access logs? BioTel claims that there is no evidence of misuse of the data (and they are offering complimentary monitoring/restoration services). But how many unauthorized IP addresses accessed the data? How many downloaded it? BioTel says it will necessitate the vendor to securely delete all files after they securely supply them to BioTel. That seems prudent. This incident is not yet up on HHS’s public breach tool. DataBreaches.net hopes that OCR does not just close its investigation just because BioTel has now disclosed. Something went wrong here and a thorough review of risk assessment, business relate agreements, certificate protections, and incident response seems in order. DataBreaches.net reached out to HealthSplash to ask them whether they ever notified BioTel of the leak last August and whether they examined logs to determine how many unauthorized IP addresses may experience accessed or downloaded data from the misconfigured bucket. No answer has been received by publication time, but this stake will be updated if a answer is received.
