DataBreaches really and truly does not understand how entities can take so long to investigate some breaches before disclosing them. If HHS feels that seven months from the first detection of an attack to notification is reasonable or acceptable, then let it change the regulations. If it is not acceptable and HHS wants entities to…
Category: Health Data
Associated Eye Care Partners, LLC discloses vendor breach. Can you guess which vendor?
One of the breach notices that showed up in routine searches this morning was from Associated Eye Care Partners, LLC (“AEC”). The first sentence of the notification letter was: We are contacting you to inform you of a data incident experienced by a third-party vendor for Associated Eye Care Partners, LLC (“AEC”). My mind…
Bits ‘n pieces, Saturday edition
The following are four more incident reports DataBreaches has noted. It is not yet clear whether some of them involve patient data or not. CAROLINA BEHAVIORAL HEALTH ALLIANCE in North Carolina has been notifying law enforcement, state regulators, and patients about a ransomware attack they detected on March 20, the day after it began. Covered…
Health Aid of Ohio settles class action lawsuit stemming from 2021 ransomware attack
There’s one thing I am sure of: even if I fail to cover some breaches on this site, class action lawyers will still be busy suing entities. Top Class Actions reports a settlement in a suit involving a Health Aid of Ohio breach in February of last year. Although not reported on this site at…
Ca: How the court bolstered an insurer’s exclusion for privacy breach
David Gambrill reports: Acting recklessly in breaching the confidential medical files of patients effectively falls within a hospital insurer’s commercial policy exclusion for committing an ‘intentional act,’ Ontario’s top court has ruled. The Ontario Court of Appeal found a hospital insurer, the Healthcare Insurance Reciprocal of Canada, does not have a duty to defend a…
WY: Former Employee Inappropriately Accessed Cheyenne Regional Medical Center Patient Health Records
Phoenixville Hospital was just one of two reports this week involving employees behaving badly by accessing patient files without a legitimate purpose. On July 6, Cheyenne Regional Medical Center in Wyoming revealed that a former employee had inappropriately accessed several patients’ personal health records between August 31, 2020, and May 26, 2022. In this case,…