Hospice Suffers Breach Exposing Nearly All The Data You Try To Keep Safe

If dealing with a loved one in the hospice system isn’t emotional enough, some people in or connected to a hospice center in Tennessee have now also had their protected healthcare information (PHI) or other sensitive information compromised by a hacker or hackers who infiltrated the email system. Of course Alive Hospice did have security measures in place, but in this case, it was a phishing attack that allowed the infiltrators to be successful.

An investigation found that the compromise occurred on or near December 20 of last year. A second compromise occurred near April 5 of this year. Both accounts had PHI in them. However, Alive Hospice does not know if the attacker(s) saw or retrieved the information. Therefore, they have notified those affected and are offering a year of free credit monitoring services.

If you receive a letter in any case where your sensitive information was potentially or definitely accessed, take advantage of the free credit monitoring service. Just remember that these do not protect you against identity theft or fraud. However, you will be notified if your credit report is accessed. If it isn’t you, then you’ll be able to address it right away.

If you have a credit freeze active on your credit report, keep in mind that it prevents anyone from accessing it, including you. For example, if you’re a landlord and trying to verify credit for a potential tenant, the credit bureaus also often need to verify your identity before they will release a report to you. If your credit is frozen, you will need to unfreeze it so that process can take place. You can always remove it temporarily. There may be a fee, but protecting your credit from potential fraud is worth the few minutes of effort and small charge that may be assessed to do it.

In addition, be extra diligent with checking your credit report for the next two years. Report anything even slightly suspicious to the reporting agency.

Humans are still the weakest link in any office environment, or otherwise. We have feelings and emotions. We’re curious and want to be entertained. Often that means we click a link to see a cute cat video or really want to know what’s behind that curtain. Well, unfortunately, that might be more dangerous than cat scratch fever. Someone at Alive Hospice clicked a malicious link or opened an attachment that allowed the attackers access to lurk in the network for a long time undetected.

If you want to click something that comes in an email, verify it first. This is especially important if you don’t know the sender or are not expecting the link or attachment regardless of who sends it.

Alive Hospice has stated in the breach notice that it has “stringent security measures” in place to protect against this sort of imposition. However, it will need to re-assess them and perhaps consider additional awareness training. A little bit of ongoing awareness may have prevented the incident from occurring at all.

It’s unclear how many patients were affected. However, the list of information accessed was extensive. It included names, driver license numbers, social security numbers, passport numbers, financial account information, treatment details, birth and/or death certificates, biometric information, and basically everything that an organization should go to great lengths to protect.