Data breach with Harbor Regional Health vendor; potentially affected patients contacted

A data breach could have released local patient information.

Harbor Regional Health has announced that they were made aware of a data breach within CaptureRx, a vendor used by the local medical group.

According to the release, CaptureRx is is used to handle tasks associated with 340B compliance, and helps HRH’s Medicare and Medicaid patients access reduced drug prices on eligible prescriptions. 

“The 340B Drug Pricing Program provides financial help to hospitals serving vulnerable communities to manage rising prescription drug costs. Section 340B of the Public Health Service Act requires pharmaceutical manufacturers participating in Medicaid to sell outpatient drugs at discounted prices to health care organizations, like HRH, that care for many uninsured and low-income patients.”

HRH made public notice to share information that it has received from CaptureRx about the incident.  

The medical group says that on February 6, 2021, CaptureRx became aware of unusual activity involving certain of its electronic files. Following an investigation, CaptureRx determined that certain files were accessed and acquired without authorization.

On or around March 19, 2021, CaptureRx completed a review to confirm the full scope of affected individuals and associated covered entities to which the information related and began notifying patients between March 30, 2021 and April 7, 2021. 

Since that time, the company has worked with healthcare providers to notify affected individuals whose information was identified by the review.

The investigation determined that, at the time of the incident, the relevant files contained first name, last name, date of birth, and prescription information. 

“CaptureRx has assured HRH of their ongoing commitment to the security of information. They are reviewing and enhancing all policies and procedures, and additional workforce training is being conducted to reduce the likelihood of a similar future event. CaptureRx is also working with healthcare providers to notify individuals whose information was contained in the subject files as well as appropriate regulatory authorities, and has begun notifying potentially affected patients of the data breach.”

HRH tells KXRO that although this security incident occurred with one of their service providers, they have also taken the opportunity to review their own security protocols and safeguards to protect information maintained within their systems. 

To learn more about the breach please visit www.ghcares.org/capturerx

 

What You Can Do. CaptureRx encourages individuals to remain vigilant against incidents of identity theft and fraud, to review account statements and explanation of benefits forms, and to monitor free credit reports for suspicious activity and to detect errors.  Additionally, affected patients should be vigilant when receiving and responding to correspondence or inquiries from unknown sources, and should take steps to protect their identity and to monitor their personal accounts for unusual activity.

For More Information. To learn more about the incident, a web page created by CaptureRx addressing the incident is available at https://www.capturerx.com/data-incident/.  CaptureRx has also established a dedicated assistance line at (855) 654-0919 (toll free), Monday – Friday, 9:00 a.m. to 9:00 p.m., Eastern Time for any questions individuals have.