On April 5, Metrocare Services in Texas notified HHS that it was notifying 5,290 clients of a breach. A notice on their web site explains:
On February 6, 2019, we learned an unauthorized third party gained access into some Metrocare employees’ email accounts beginning on January 2019. We immediately took steps to secure the accounts and began an investigation. The investigation determined the unauthorized access occurred and could not rule out whether emails containing individuals’ information were accessed by the third party. We determined information of some individuals were in the affected email accounts, and may have included individuals’ names, dates of birth, health insurance information, driver’s license information, health information related to services received connected to Metrocare, and in some cases, Social Security numbers.
You can read the full notice on their site, which includes steps they have taken to prevent a recurrence. It’s a shame they didn’t take all of these steps in November, 2018 when they had what sounds like an identical breach, but did not follow up by implementing multifactor authentication. At that time, they wrote:
To help prevent something like this from happening in the future, Metrocare is taking steps to add additional security measures to its current information technology infrastructure, including strengthening its email system, and providing additional information security training to its employees.
That incident has no closing summary on HHS’s public breach, so it may still be under investigation.
This time, they write:
To help prevent something like this from happening in the future, we are taking steps to add additional security measures to our current information technology infrastructure, including strengthening the security of our e-mail system and have implemented multi-factor authentication on its email systems.
The breach in 2018 affected more than 1,800 patients. The more recent breach, which was also discovered within a month after it started, affected more than 5,200 patients. Will OCR find Metrocare’s actions reasonable? And what happens if this happens again?