Nearly 438,000 patients affected in January-reported breaches

Providers, health plans and their business associates reported 29 breaches affecting nearly 438,000 patients to the federal government in the first month of 2020.

While the overall number of breaches is down in January compared to December, 10% more patients were affected, according to data from the HHS' Office for Civil Rights, the agency that maintains the government's database of healthcare breaches. But it's down from last year's January, when breaches exposed data of almost 578,000 patients.

A breach at not-for-profit health system PIH Health in California—the result of an email phishing campaign—was the only incident reported to the OCR in January that affected more than 100,000 people.

The largest healthcare breach reported in 2019 involved exposure of 11.5 million patients' data.

PIH Health in June discovered that some employee email accounts might have been compromised in a targeted email phishing scheme. After an investigation by a third-party cybersecurity team, the system said it in October received confirmation that unauthorized users had accessed certain employee email accounts during about one week in June.

PIH Health told OCR on Jan. 10 that the breach affected an estimated 199,548 patients.

HHS gives HIPAA-covered entities 60 days from when they discover a breach to notify the department. PIH Health in a notice posted online said it learned from the third-party cybersecurity team that the employee email accounts in question contained the health data of some current and former patients in November.

"Upon learning about the security incident in June 2019, PIH Health immediately launched an investigation and engaged leading, independent cybersecurity experts to provide assistance," PIH Health said a statement. "We went through the regulatory process as appropriate which took months for review."

The investigation has found no evidence indicating that health data included in the email accounts has been misused, the health system said.

Hacking and IT incidents accounted for more than half of the 29 breaches submitted to the OCR in January, at just over 60%.

The remaining breaches reported in January resulted from theft, improper disposal, unauthorized access or unauthorized disclosure of records.