DHHS and Aging Partners Notified of Protected Health Information Breach

LINCOLN, Neb. (KOLN) – The Nebraska Department of Health and Human Services reported Friday that the US Department of Health and Human Services Civil Rights Bureau has been notified of an incident involving a breach of protected information on the health care that occurred under Aging Partners, a service of the City of Lincoln. On May 25, 2021, the City’s information service discovered that between May 18, 2021 and May 21, 2021, following a “phishing” scam, an unauthorized person had access to the accounts of mailbox containing a total of over 46,000 e-mails, some of which contained protected health information.

When Aging Partners learned of the incident, the City immediately disconnected access to the risky emails and new access codes were established. City staff investigated and determined that some information protected by HIPAA was vulnerable.

The City then entered into a contract with a third-party forensic company to determine the extent of the violation. Taking the strictest precautions regarding information security, Aging Partners examined over 46,000 individual emails to identify any possible HIPAA-related information that could have been viewed or disclosed. Emails involving 1,513 program participants were determined to contain one or more Protected Health Information Identifiers. These identifiers included one or more types of personal information, such as name, address, date of birth, phone number, social security number, date of service, type and amount of service, or other health information (i.e. care assessments or medication lists). The majority of emails contained only the names of program participants.

A small number of emails in the information breach contained bank account or other financial information. These people will have the opportunity to benefit from professional monitoring of the credit paid by Aging Partners.

All program participants, whose protected health information may have been at risk of access or disclosure, will receive information from Aging Partners through First Class Mail. Affected consumers should call one of the toll-free numbers of the three major credit bureaus for a free annual credit report to monitor any suspicious activity. Participants should also consider placing a fraud alert on their credit report to prevent misuse of the information. The monitoring offices are: Equifax, 800-685-1111 or at www.equifax.com/personal/credit-report-services; Experian, 888-397-3742 or Experian.com/help; and TransUnion 888-909-8872 or https://www.transunion.com/fraud-alerts.

Randall Jones, Director of Aging Partners, emphasizes that the confidentiality of information provided to Aging Partners by DHHS is a top priority for their organization and that they continually strive to improve their processes, including the security of personal information. and constant compliance with HIPAA regulations. In addition to the immediate elimination of access, additional measures taken by Aging Partners to mitigate this breach include ongoing cybersecurity training for Aging Partners staff and the implementation of additional safeguards to prevent future breaches.

DHHS will continue to monitor the implementation of Aging Partners’ supplemental safeguards to ensure their plan to mitigate the breach meets all Nebraskan privacy requirements.

Pursuant to federal regulation 45 CFR 164.406, the Nebraska DHHS is required to notify the public of a breach by one of its contractors of insecure protected health information involving more than 500 state residents. In addition, in accordance with contractual obligations with the DHHS, the City of Lincoln is required to notify all those affected by the violation and the Office of Civil Rights.

Aging Partners clients are encouraged to contact Randall Jones, Director of Aging Partners at 833-952-0001 or [email protected]; for more information contact the Nebraska Department of Health and Human Services, HIPAA Office at [email protected].

Copyright 2021 KOLN. All rights reserved.