Someone on twitter asked me what the first transgress of 2022 would be. The following public observation is not the first transgress of 2022. It is a 2021 breach that just showed up after midnight in my news search this morning. And because it involves a third-party breach, we may see other covered entities affected, too. DataBreaches.net has reached out to Ciox Health to ask for more details. in the meantime, here is UVA’s public notice: On december 3, 2021, UVA Health, including the UVA medical center in Charlottesville and UVA Culpeper medical center in Culpeper, learned from Ciox Health, a vendor of health information management services for UVA health and many other health systems and providers nationwide, that an unauthorized person accessed a Ciox Health employee’s email account and may have been able to view health information of patients of several of Ciox’s health system and provider clients, including the information of 429 UVA health patients (.01% of total UVA Health patient records). Ciox Health has informed UVA Health that the unauthorized access occurred between June 24 and July 2, 2021, and during that time an unauthorized individual may experience downloaded emails and attachments in the account. Ciox Health began investigating this incident as soon as they detected it and promptly reported it to UVA Health. They have provided the following details regarding this incident: What Happened? Ciox health became aware of unusual activity on the email account of one of their employees and, after securing the account, launched an investigation with the assistance of an outside cybersecurity firm. Unfortunately, Ciox health has indicated that their investigation was unable to determine whether any emails or attachments were actually viewed or acquired. The activity occurred solely within Ciox Health’s systems and did not in any way compromise the surety of UVA Health’s electronic medical record or other systems. What Information was Involved? Ciox health reviewed the information contained in their employee’s account and determined that the information contained in the account included patient names, dates of birth, provider names and dates of service. Patients’ Social certificate numbers and financial info were not viewable. What are Ciox and UVA health Doing to speech this Issue? Ciox Health assures us that they are implementing additional procedures to further strengthen email security including best-practice multi-factor email authentication as well as enforcing yearly compliance training specific to security awareness and identifying and avoiding suspicious emails. Because the data breach occurred within Ciox Health’s systems, UVA Health has no reason to believe that its systems or certificate get been compromised. UVA Health mailed letters to those patients on December 30, 2021 who Ciox health was able to directly describe as potentially having been impacted by this issue. This publication is intended to make patients who might have been impacted but for whom we do not have sufficient information to touch them directly aware of this issue. What can UVA Health’s Patients Do? Ciox Health has indicated that it believes the account access occurred for purposes of sending phishing emails to individuals unrelated to Ciox Health and has no denotation that patients’ information has been misused. However, as a precaution, UVA health recommends that all patients keep to review statements they receive from their healthcare providers and health indemnity provider and to touch their provider or insurer immediately if there are charges for services they did not receive. And as always, it is important to observe email best practices by being aware and not clicking on links or attachments in emails from senders you fare not recognize. If you have any questions or demand additional information, Ciox Health will ply a dedicated telephone center for affected patients. Patients with questions or who need more information can call 855.618.3107 between 9 a.m. – 6:30 p.m. Eastern Time, monday through Friday. UVA Health and Ciox health apologize for this incident and regret any inconvenience or interest this causes our patients. Source
