AdaptHealth is investigating a cybersecurity incident after determining that unauthorized access to its systems resulted in the exfiltration of patient data and insurance billing information.
According to a July 2 Securities and Exchange Commission filing, the home medical equipment provider said a threat actor gained unauthorized access to certain cloud-based business applications, including internal patient management systems and document storage platforms.
On June 15, the company received a communication from the threat actor claiming to have obtained data from its systems. AdaptHealth said it has confirmed that data was exfiltrated, including a stored password file associated with insurance billing, and that certain external electronic health record system portals were accessed.
The affected data includes passwords associated with insurance billing, as well as certain patients’ personally identifiable information and protected health information, the filing said. AdaptHealth said the affected systems did not contain Social Security numbers, financial account information or payment card information.
The company said the incident stemmed from a successful social engineering attack that compromised the user session of a third-party contractor. After detecting the intrusion, AdaptHealth disabled the compromised account, reset affected credentials and implemented additional access controls. The company said the incident has been contained and that it is continuing its investigation with external forensics teams.
AdaptHealth said it has not yet determined the full scope of the affected datasets, and that specific information regarding the volume of data at issue is not yet available. The company also said it has taken steps intended to mitigate the risk of dissemination of the exfiltrated data.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.