Massachusetts AG settles with Transformative Healthcare for $1M over 750,116-resident data breach and MassHealth upcoding
The Massachusetts Attorney General settled alleged HIPAA and Massachusetts Data Security Law violations with former medical transportation provider Transformative Healthcare, LLC and its subsidiaries Lifeline and Fallon. The settlement also resolves MassHealth upcoding allegations, and the combined allegations carry a $1,000,000 penalty payable over five years. Fallon identified the incident on April 21, 2023. An unauthorized third party accessed systems holding patient and employee data between February 17, 2023 and April 21, 2023, during an archiving process. The personal and health information of 750,116 Massachusetts residents was exposed and potentially stolen. The AG found that Transformative Healthcare failed to maintain an appropriate written information security program.
Detalhes técnicos
- Unauthorized access to systems holding patient and employee data occurred during an archiving process, from 2023-02-17 to 2023-04-21.
- Exposed data: names, contact information, dates of birth, driver's license numbers, state ID numbers, Social Security numbers, medical information and health insurance information.
- The article does not identify the attacker, the malware or the intrusion method.
- Violations found: Massachusetts Data Security Regulations and HIPAA 45 CFR Part 164 Subparts A, C (Security Rule) and E (Privacy Rule).
- Fraud allegations: billing MassHealth for emergency services when only nonemergency services were provided, and false Advanced Life Support claims. This was investigated separately from the breach.
Remediação
- The consent judgment requires compliance with the Massachusetts Consumer Protection Act, Data Breach Notification Law, Data Security Regulations, Dispositions and Destruction of Records Law, and the HIPAA Privacy and Security Rules.
- Personal information and PHI must be destroyed within 45 days of the effective date of the consent judgment.
Linha do tempo
-
Massachusetts AG settles with Transformative Healthcare for $1M over 750,116-resident data breach and MassHealth upcoding
ler a análise desta fonte ocultar
The Massachusetts Attorney General settled alleged HIPAA and Massachusetts Data Security Law violations with former medical transportation provider Transformative Healthcare, LLC and its subsidiaries Lifeline and Fallon. The settlement also resolves MassHealth upcoding allegations, and the combined allegations carry a $1,000,000 penalty payable over five years. Fallon identified the incident on April 21, 2023. An unauthorized third party accessed systems holding patient and employee data between February 17, 2023 and April 21, 2023, during an archiving process. The personal and health information of 750,116 Massachusetts residents was exposed and potentially stolen. The AG found that Transformative Healthcare failed to maintain an appropriate written information security program.
Technical Details
- Unauthorized access to systems holding patient and employee data occurred during an archiving process, from 2023-02-17 to 2023-04-21.
- Exposed data: names, contact information, dates of birth, driver's license numbers, state ID numbers, Social Security numbers, medical information and health insurance information.
- The article does not identify the attacker, the malware or the intrusion method.
- Violations found: Massachusetts Data Security Regulations and HIPAA 45 CFR Part 164 Subparts A, C (Security Rule) and E (Privacy Rule).
- Fraud allegations: billing MassHealth for emergency services when only nonemergency services were provided, and false Advanced Life Support claims. This was investigated separately from the breach.
Remediation
- The consent judgment requires compliance with the Massachusetts Consumer Protection Act, Data Breach Notification Law, Data Security Regulations, Dispositions and Destruction of Records Law, and the HIPAA Privacy and Security Rules.
- Personal information and PHI must be destroyed within 45 days of the effective date of the consent judgment.