◆ Several senators have unveiled data privacy legislation, in a sign that Congress is considering changes to existing law following numerous high-profile data breaches, including many in the health care arena. Sen. Catherine Cortez Masto (D-Nev.) recently introduced a proposal that would strengthen data privacy protections for consumers while ensuring corporations not currently covered by HIPAA are focused on implementing new data security standards and privacy protections. The bill would require consumer opt-in when a company collects genetic, biometric or precise location data. Meanwhile, a plan from Sen. Marco Rubio (R-Fla.) would supersede what Rubio called “a patchwork of state privacy and federal laws that apply to particular categories of information, such as health” to impose one single, comprehensive federal law regulating the collection and use of personal data. View Cortez Masto’s proposal at https://bit.ly/2T7n2th and Rubio’s plan at https://bit.ly/2WAJQyF.
◆ Device and software maker Zoll Medical said a data breach during a recent email server migration exposed protected health information (PHI) for 277,319 patients. “Zoll’s email is archived by a third-party service provider to comply with record retention and maintenance requirements, policies and procedures,” the company said in a statement. “Some personal information was included in the email communications stored by the third-party service provider. During a server migration, some data from Zoll emails was exposed.” The vendor believes this occurred between Nov. 8 and Dec. 28, 2018. Information might have included names, addresses, dates of birth, limited medical information, and for a small percentage of patients, Social Security numbers. Zoll said it was taking steps to review its process for managing third-party vendors. See the company’s breach notification at https://prn.to/2JTrzLO.
◆ The Oregon Department of Human Services disclosed that two million agency emails had been breached in January following a phishing attack, potentially exposing personal medical information for hundreds of thousands of patients. The agency said it discovered the breach on Jan. 8 and realized the emails included PHI by Jan. 28. Nine individual employees opened a phishing email and clicked on a link that compromised their email and allowed access. A spokesperson for the agency said the breach affected at least 350,000 clients of the department, which provides food assistance, child care assistance, help to families with disabled children, long-term and in-home care to seniors and people with disabilities, and employment services. Data breached may include first and last names, addresses, dates of birth, Social Security numbers, case numbers and other information used to administer programs. The agency said it has hired ID Experts to perform a forensic review to determine the extent of the breach. More information is available at https://bit.ly/2Wdlv1N.
