On September 29, 2018, Baylor Scott & White Medical Center – Frisco, a joint venture managed by United Surgical Partners International (USPI), discovered that more than 47,000 patient records may have been compromised when the hospital uncovered an issue with the credit card processing system of a third-party vendor. The Texas hospital was required to notify federal regulators under the HIPAA Breach Notification Rule.
Data that may have been accessed by hackers includes name, mailing address, telephone number, date of birth, medical record number, date of service, insurance provider information, account number, last four digits of the credit card used for payment, the credit card CCV number, type of credit card, date of recurring payment, account balance, invoice number and status of transaction.
The hospital assures it patients that medical record information and social security numbers were not accessed; however, name, address, date of birth and medical record number may have been accessed by hackers. Under HIPAA, name, address, date of birth and medical record number are all considered protected health information (PHI).
Corrective Action
In addition to terminating the relationship with the vendor, Baylor Scott & White Medical Center – Frisco is also offering affected patients or guarantors one year of free credit monitoring services through TransUnion Interactive. However, the damage may have already been done. According to an article by Health IT Security, health information is more valuable than just credit card information or financial data alone, and hackers could sell the information on the dark web for more money than a social security number.
Breaches on the Rise
The U.S. Department of Health and Human Services Office for Civil Rights maintains a breach portal, commonly called the "wall of shame," of all breaches of unsecured PHI affecting 500 or more individuals. Currently, the list contains more than 400 breaches in just the last 24 months. Each breach is currently under investigation by the Office for Civil Rights.
Breaches can be inevitable, but healthcare organizations must do everything in their power to protect PHI and avoid a breach. To accomplish this, a good vendor risk management program should be implemented. Third-party vendors must be inventoried, classified and assessed to determine their level of inherent risk on the healthcare organization. Once assessed, you can determine if their level of risk is acceptable, if you need them to go through a remediation process, or if you need to discontinue your relationship with this vendor. By doing so, healthcare organizations can show due care and create a defensible position in the event of a breach.
Estimate your score or book free demo today
Estimator | Get a Demo
