Blue Lance InfoSec Blog

Johns Hopkins employee among five indicted in ID theft scheme using stolen patient information

A Johns Hopkins employee and four other individuals were indicted this week for their roles in a credit fraud scheme using patient data stolen from the hospital, resulting in more than $600,000 in fraudulently obtained credit.

The indictment alleges that between August 2007 and March 2009, Jasmine Amber Smith allegedly provided names, social security numbers, dates of birth and addresses of patients and the parents and guardians of minor patients to the others.  The data was then used to apply for instant credit and make purchases before the credit cards were received by the victims.

The statement does not provide specific details on how many patient records were stolen, only saying "more than 50 business and individuals were affected".

The full press release from the Maryland U.S. Attorney's Office is below:

A federal grand jury has indicted the following five Maryland defendants on fraud and aggravated identity theft charges in connection with a scheme to use stolen hospital patient identity information to open fraudulent credit accounts and make purchases on “instant credit” at retail stores in Maryland: 

Michael Allen, age 34, of Baltimore, 
Jasmine Amber Smith, age 25, of Nottingham,
Tyrell Douglas McCormick, age 22, of Baltimore, 
Ayanna Devon Johnson, age 38, of Baltimore, and
Gloria Canada, age 54, of Baltimore. 

The superseding indictment was returned on September 15, 2010 and unsealed today upon the arrest of the final defendant, Gloria Canada. 

The indictment was announced by United States Attorney for the District of Maryland Rod J. Rosenstein; Special Agent in Charge Barbara Golden of the United States Secret Service – Baltimore Field Office; Postal Inspector in Charge Daniel S. Cortez of the U.S. Postal Inspection Service - Washington Division; and Chief James W. Johnson of the Baltimore County Police Department. 

According to the 39 count superseding indictment, while employed by Johns Hopkins Hospital from August 2007 to March 2009, Smith is alleged to have improperly accessed the records of the hospital’s patients to obtain the personal identity information of patients and the parents and guardians of minor patients, including names, social security numbers, dates of birth and addresses. Smith allegedly provided the stolen identity information to Johnson and Canada. From May 2008 to June 2009, Allen and McCormick allegedly used the stolen information to apply for instant credit at stores located in Maryland and make purchases on “instant credit” before the fraudulently-obtained credit cards were received by the victims. 

The indictment alleges that during the course of the scheme, the defendants fraudulently obtained over $600,000 in credit from over 50 institutional and individual victims. 

The defendants face a maximum sentence of 30 years in prison for conspiracy to commit bank fraud and two years in prison consecutive to any other sentence for aggravated identity theft. In addition, McCormick and Allen face a maximum sentence of 30 years in prison for bank fraud and 15 years in prison for access device fraud. Canada is scheduled to have her initial appearance in U.S. District Court in Baltimore today at 2:00 p.m. 

An indictment is not a finding of guilt. An individual charged by indictment is presumed innocent unless and until proven guilty at some later criminal proceedings. 

United States Attorney Rod J. Rosenstein commended the U.S. Secret Service – Baltimore Field Office, the U.S. Postal Inspection Service - Washington Division and the Baltimore County Police Department for their work in the investigation. Mr. Rosenstein thanked Assistant United States Attorneys Tamera Fine and James Warwick, who are prosecuting the case.

Employee snooping costs 5 California hospitals $675K in fines

The California Department of Public Health (CDPH) announced the assessment of fines and penalties of $675,000 to five California hospitals for failing to prevent unauthorized access to confidential patient information.

The following hospitals received penalties:

1. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $250,000 fine after the facility failed to prevent unauthorized access of 204 patients’ medical information by one employee.
2. Community Hospital of San Bernardino, San Bernardino, San Bernardino County: The hospital was assessed a $75,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by one employee.
3. Enloe Medical Center, Chico, Butte County: The hospital was assessed a $130,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by seven employees.
4. Rideout Memorial Hospital, Marysville, Yuba County: The hospital was assessed a $100,000 fine after the facility failed to prevent unauthorized access of 33 patients’ medical information by 17 employees.
5. Ronald Reagan UCLA Medical Center, Los Angeles, Los Angeles County: The hospital was assessed a $95,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by four employees.
6. San Joaquin Community Hospital, Bakersfield, Kern County: The hospital was assessed a $25,000 fine after the facility failed to prevent unauthorized access of three patients’ medical information by two employees.

Each of the hospitals are required to submit a plan of correction within 10 working days.

Read the press release.

Ex-UCLA Healthcare Employee receives first prison sentence for HIPAA violations

Huping Zhou, a former UCLA Healthcare employee who pleaded guilty to illegally accessing private patient data, was sentenced yesterday to four months in federal prison, becoming the first individual in the nation to receive a prison sentence for violating HIPAA privacy provisions.

From the FBI Press Release:

Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers. For the next three weeks, Zhou's continued his illegal accessing of patient records and expanded his illegal conduct to include confidential health records belonging to various celebrities. According to court documents, Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities.

In his plea agreement, Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information.

Read the full press release

Florida couple indicted for theft of patient data

The FBI and the U.S. Attorney for the Southern District of Florida announced the indictment of Ruben Rodriguez and Maria Victoria Suarez, a Coral Gables couple, for the theft of personal data from patients to be sold to personal injury lawyers and clinics.  The information would then be used to solicit those patients for lawsuits.

According to the indictment, defendant Rodriguez solicited the assistance of a co-conspirator, who at the time was employed by AMR, an ambulance service provider that offered emergency and non-emergency medical transport services in Miami-Dade County. Defendant Rodriguez reached an agreement with the co-conspirator that required the co-conspirator to illegally gain access to certain personal information of individuals transported by AMR and to turn over that information to Rodriguez, in exchange for payments from Rodriguez.

The indictment further alleges that defendant Rodriguez would, in turn, sell the personal identification information he received from the co-conspirator to either of the following: (1) personal injury attorneys, who would use the personal identification information to improperly solicit individuals transported by AMR with hopes of representing them in future legal proceedings; and/or (2) personal injury clinics, who would use the personal identification information to improperly solicit individuals transported by AMR to offer medical services. The payments defendant Rodriguez received from the attorneys and clinics were determined, in part, by any resulting lawsuits, settlements, payments, and/or reimbursements.

The indictment additionally alleges that in the midst of this conspiracy, defendant Rodriguez introduced the co-conspirator to defendant Suarez, his wife, who thereafter, along with defendant Rodriguez, purchased the illegally obtained information from the co-conspirator for subsequent resale to others, as described above.

According to CBS4 in South Florida, this is not the first time the pair has bagged for this type of activity:

The couple was charged with conspiracy to steal patient records from Jackson Memorial Hospital last year. Rodriguez and Suarez allegedly used the same technique to get the information and get rich off of it. 

According to investigators Rodriguez paid JMH ultrasound technician Rebecca Garcia $1000 a month for patient records between December 2006 and February 2009. 

An unnamed personal-injury lawyer reportedly wrote checks worth more than $85,000 to a shell company between 2006 and 2009. The false account allegedly provided Rodriguez and Suarez kickback money.

That case has not yet gone to trial.  Let's hope the courts have the good sense to hold them without bail this time.

VA launches criminal investigation into employee for downloading patient data

Nextgov reports that the inspector general at the Veterans Affairs Department has launched an investigation into a physician assistant, who allegedly downloaded patient data.

The assistant allegedly recorded two sets of patient data on to a personal laptop for research purposes. One set included three years' worth of patient data and another held 18 years of medical information, according to a source familiar with the incident and who asked not to identified.

There are conflicting reports on how the data was obtained:

Roger Baker, VA's chief information officer, commented on an item about the incident that was posted Monday evening on a Nextgov blog that the physician assistant's laptop was never connected to the VA network and any data she recorded on her laptop was "hand entered."

But the source told Nextgov the VA inspector general is investigating whether the assistant used two thumb drives to transfer the data to the laptop.

No word on how many patients were involved or whether or not they would be contacted.  Hopefully, the VA's IT department has an detailed user audit trail to work with to shed some light on this incident. 

Sources: Nextgov, Open Security Foundation (OSF)

Connecticut AG Sues Healthcare Provider in First Case of State Enforcement Under HITECH

Connecticut Attorney General Richard Blumenthal sued Health Net of Connecticut, Inc. for HIPAA violations stemming from the loss of a portable hard drive containing the health and financial information of approximately 446,000 Connecticut enrollees in May of 2009, and the failure to notify authorities and consumers for at least 6 months.

Additionally, the AG seeks a court order preventing Health Net from continued HIPAA violations by requiring that protected health information stored on portable drives be encrypted.

A subsequent investigation found that the data, which included health records, social security numbers and bank account numbers in over 27 million scanned pages, was not encrypted or otherwise protected from unauthorized access and was viewable on commonly available software.

The case is the first action taken by a state under the HITECH Act, which enables states to enforce HIPAA violations.

Source:  Connecticut Attorney General's Office

Ex-UCLA Healthcare Employee Pleads Guilty to HIPAA Violations

Apparently, the management at the UCLA Healthcare System could not foresee a security risk with giving notice to employees of their intent to terminate them. 

From the Los Angeles office of the FBI:

 LOS ANGELES—A former UCLA Healthcare System employee pleaded guilty today to four counts of illegally reading private and confidential medical records, mostly from celebrities and other high-profile patients.

Huping Zhou, 48, of Los Angeles, pleaded guilty prior to a trial scheduled to begin next week to four misdemeanor counts of violating the federal privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA). Appearing before United States Magistrate Judge Andrew J. Wistrich, Zhou specifically admitted to knowingly obtaining individually identifiable health information without a valid reason, medical or otherwise. Zhou becomes one of the first people in the nation to be convicted of violating the privacy provisions of HIPAA.

Zhou, who is a licensed cardiothoracic surgeon in China, was employed in 2003 at UCLA Healthcare System as a researcher with the UCLA School of Medicine. On October 29, 2003, Zhou received a notice of intent to dismiss him from UCLA Healthcare for job performance reasons unrelated to his illegal access of medical records. That night, Zhou, without any legal or medical reason, accessed and read his immediate supervisor’s medical records and those of other co-workers. For the next three weeks, Zhou’s continued his illegal accessing of patient records and expanded his illegal conduct to include confidential health records belonging to various celebrities. According to court documents, Zhou accessed the UCLA patient records system 323 times during the three-week period, with most of the accesses involving well recognized celebrities.

In a plea agreement filed today, Zhou admitted that he obtained and read private patient health and medical information on four specific occasions after he was formally terminated from the UCLA Healthcare System. Zhou acknowledged that at the time he viewed these patients’ medical information, he had no legitimate reason, medical or otherwise, for obtaining the personal information.

“There is a persistent problem with improper and illegal viewing of medical records by individuals who abuse the access they have as a result of their employment,” Acting United States Attorney George S. Cardona said. “HIPAA’s criminal privacy provisions protect not only celebrities, but all of us from curious neighbors, disgruntled co-workers, and other snoopers.”

Zhou is scheduled to appear in federal court on March 22 to be sentenced by Judge Wistrich. At sentencing, Zhou faces a maximum statutory penalty of four years in federal prison.

“The FBI is committed to investigating violations of HIPAA laws, the compromise of which can cause major financial or emotional distress,” said Steven M. Martinez, Assistant Director in Charge of the FBI in Los Angeles. “These laws exist to protect the privacy that must be afforded to all patients, despite how intriguing that information might be to some with unworthy intentions.”

The UCLA Healthcare System, the UCLA School of Medicine and the UCLA Medical Group fully cooperated in the investigation, which was conducted by the Federal Bureau of Investigation.

16 Employees Fired for Alleged HIPAA Violations

An article by ABC13 in Houston reports that the Harris County Hospital District terminated 16 employees for HIPAA violations after they accessed the medical records of a fellow employee, Dr. Stephanie Wuest, who had been shot during an attempted robbery.

Read the entire story

Two Violate HIPAA Disclosure Laws During Illegal Drug Scheme

The United States Attorney for the Northern District of Alabama announced on August 28th that Isaac Earl Smith, 38, and Annetra Poole-Moore, 37, have agreed to plead guilty to federal crimes involving healthcare fraud, disclosures prohibited by the Health Insurance Portability and Accountability Act (HIPAA), and aggravated identify theft.
 
Between September 2008 and April 2009, Smith, of Pleasant Grove, and Moore, of Midfield, engaged in a criminal conspiracy to commit health care fraud, according to separate plea agreements filed today in U.S. District Court. During that time, Moore was employed by UnitedHealthcare Inc. (“UHC”) as a claims representative associate.  There, Moore had access to the personal information, including the means of identification, of certain persons enrolled in flexible spending accounts administered by UHC.  Without authorization or approval from UHC, Smith and Moore gained access to the company’s electronic database and obtained names and dates of birth of certain persons who had flexible spending accounts and were also covered by a prescription drug plan sponsored by the Federal Employees Health Benefit Plan (“FEHBP”).
 
The defendants and others used this information to create counterfeit prescriptions.  These prescriptions were then presented to pharmacies for the purpose of illegally obtaining controlled substances, which were then illegally sold to third parties.  By using the stolen identities on the prescriptions, the defendants caused FEHBP’s prescription drug plan to pay for the controlled substances, costing the FEHBP almost $73,000.
 
Smith intends to plead guilty to one count of conspiracy to commit health care fraud, one count of criminally violating the HIPAA disclosure laws, and five counts of aggravated identity theft. 
 
Moore intends to plead guilty to one count of conspiracy to commit health care fraud, one count of criminally violating the HIPAA disclosure laws, and two counts of aggravated identity theft. 
 
Smith and Moore have also agreed to pay $72,746 in restitution to FEHBP and to criminally forfeit the same amount.
 
In addition to the forfeiture, the defendants each face maximum sentences of 10 years in prison and fines of up to $250,000.  The aggravated identity theft charges carry two-year minimum prison sentences.
 

Health Organizations Must Notify Patients of Security Breaches, Even if not Bound by HIPAA

Yesterday, the FTC ruled that web based businesses will be required to notify consumers in the case of a security breach involving electronic health information.  The ruling applies to businesses that offer third-party applications for personal health records and vendors of personal health records.

The new rule is part of the American Recovery and Reinvestment Act of 2009, and was put into place by Congress.  The businesses that will be affected by this rule offer services that are not already subject to HIPAA privacy and security requirements.  A study will be conducted by the Department of Health and Human Services on potential security, privacy, and breach notification requirements for entities not governed by HIPAA regulations, with a report forthcoming by February 2010.  Meanwhile, the FTC ruled that these businesses notify consumers of any breach of the security of their health information.  In addition, any service providers of these businesses that encounter a data breach must notify their client, who will then in turn notify the consumers.

The ruling details content of the breach notification, method of notification, and time constraints.  Should a breach occur involving 500 or more records, it is required that the media be notified as well as the FTC.