Health IT vendor CareCloud has reported a data breach affecting 3,756,469 individuals.
The breach traces to a network disruption CareCloud discovered on March 16 in its CareCloud Health division, which temporarily disrupted access to one of the company’s six electronic health record environments for about eight hours. A forensic investigation later determined that an unauthorized third party accessed one of CareCloud’s AWS environments between March 10 and March 16 and claimed to have exfiltrated data from databases within it.
CareCloud, which reported the number of individuals affected to HHS’ Office for Civil Rights in July (with the agency posting it in August), disclosed the incident to the SEC in a March 27 Form 8-K, after determining March 24 that the breach was material given the sensitivity of the potentially affected information. On June 24, the company determined the exposed data included patients’ full names along with other personal information, according to a notification letter filed with the Massachusetts Attorney General’s Office.
CareCloud is offering affected individuals identity theft protection, with an enrollment deadline of Dec. 17. The company offers EHRs and other clinical documentation services to healthcare organizations.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
