October-reported healthcare breaches exposed 311,000 patients' data

More than 300,000 people had data exposed in healthcare breaches reported to the federal government last month.

In October, providers, health plans and their business associates reported 47 data breaches affecting 311,430 patients to HHS' Office for Civil Rights, the agency that maintains the government's database of healthcare breaches. The 36 data breaches reported in September, by contrast, compromised data from nearly 2 million people.

October marked the first month of 2019 in which none of the individual data breaches reported to the OCR affected more than 100,000 people.

Fifteen facilities affiliated with Texas Health Resources made reports of various sizes on Oct. 22, spanning from 525 patients affected at Texas Health Harris Methodist Hospital Southlake to 14,881 patients affected at Texas Health Harris Methodist Hospital Fort Worth. The report from the Fort Worth facility represented the sixth largest incident reported in October.

However, all of the 15 reports related to the same incident at the system. Taken together, the 15 facilities reported breaches affecting 82,577 patients in total.

Texas Health Resources in August discovered an issue in its billing system had allowed patient information to be sent to the incorrect guarantor, affecting mailings between July and September. That meant some patients' names, account numbers and health insurers, among other data, was sent to people other than the patient or their guarantor.

The misconfiguration in the billing system did not expose any Social Security numbers, health insurance identification numbers or financial information, according to an online notice from Texas Health Resources.

The largest data breach reported by a single entity in October involved the Methodist Hospitals in Indiana.

Methodist Hospitals on Oct. 4 reported that 68,039 patients had data exposed to an unauthorized user after two employees fell victim to an email phishing scam. Information held in the two email accounts varied by patient, but may have included names, addresses or Social Security numbers, among other data, according to a notice Methodist Hospitals posted online.

The 15 Texas Health Resources facilities comprised more than half of the 27 data breaches that resulted from unauthorized access or unauthorized disclosure of patient records in October. The remaining 20 data breaches resulted from hacking or IT incidents, theft, and loss of patient records.