By Marianne Kolbasuk McGee (HealthInfoSec)
A defunct ambulance company is notifying nearly 912,000 patients and employees that their archived records were compromised in an early 2023 data theft hack. The firm previously provided emergency care in the Boston region and administrative services to affiliated transportation companies.
In a report to Maine’s attorney general on Dec. 29, Transformative Healthcare said its Fallon Ambulance Services subsidiary – which ceased operations in December 2022 – had experienced a hacking incident that was discovered on April 21, 2023, but appears to have started months earlier, extending from Feb. 17 to April 22.
Affected files contained information such as name, address, Social Security number, medical information – including COVID-19 testing or vaccination information – and information provided to Fallon in connection with employment or application for work, Transformative said.
While Fallon was no longer operating, the ambulance firm maintained an archived copy of data previously stored on its computer systems “to comply with legal obligations,” Transformative said in the breach notice.
“While Fallon currently has no evidence of identity theft or fraud related to consumer information as a result of this matter, the company is also offering two years of identity protection services at no cost to affected individuals,” the Transformative breach notice said.
Transformative was acquired in December 2022 by Coastal Medical Transportation Systems, a privately owned nonemergency transportation company based in Hyannis, Massachusetts.
Neither an attorney representing Transformative Healthcare in its breach report to Maine regulators nor Coastal Medical Transportation System immediately responded to Information Security Media Group’s requests for additional details about the Fallon Ambulance hacking incident.
Risks of Archived Data
Transformative reported the hacking incident to the US Department of Health and Human Services on Dec. 31 as affecting 911,757 individuals and involving electronic medical records and a network server. In its report to Maine’s attorney general, Transformative said the incident had affected about 20,486 Maine residents.
“This incident should serve notice to other organizations that may have the same issue – not necessarily going out of business, but in a position to retain data that are no longer in use, but which contain regulated elements: personally identifiable health or financial information,” said co-founder and CISO of security firm Critical Insight Mike Hamilton,.
“A good practice would be the use of off-site storage or encryption when records are no longer needed for operational purposes yet pose a risk to the business if subjected to unauthorized disclosure,” Hamilton said. Another technique would be to separate elements of the records, such that their accurate recombination would be difficult and the aggregate devalued, he added.
Vice president at privacy and security consultancy Clearwater, Dave Bailey said a recommended approach for a healthcare-related entity that is no longer operational is to conduct a thorough security risk analysis for archived records.
That analysis should involve evaluating and vetting whether the organization responsible for storing data has reasonable and appropriate controls in place, he said.
“If there is no essential business requirement for the data to be accessible or exposed to an online user base, it is advisable and good practice to limit its exposure to mitigate potential risks. Align decisions with the business case, and restrict access only to those with a genuine need,” he said.
It is also good practice to safeguard records from unnecessary risks regardless of the system in use, Hamilton added.
“The key is to minimize access, emphasizing the importance of restricting it to individuals essential for the business case. Bottom line is to prioritize minimizing exposure, keeping the archived systems up to date and current, and conduct testing to ensure you can access the data when needed. The overarching principle is to establish and enforce reasonable and appropriate controls, securing the data and validating that only authorized personnel can access it.”
While it is relatively uncommon for a business that has ceased operations to be pillaged for records, the Fallon Ambulance incident underscores the value of those patient and employee records, whether in production or not, Hamilton said.
“The types of records stolen lend themselves to financial and health fraud but also extortion. Having knowledge of an event such as domestic violence may be used to threaten individuals with disclosure of that information to employers or the community at large, and many may pay to keep that information confidential.”
Although major hacks on defunct companies appear to be fairly uncommon, other data security incidents involving nonoperational entities have occurred previously.
In 2021, security researcher Jeremiah Fowler, co-founder of consultancy Security Discovery, reported finding an unsecured database belonging to apparently recently defunct firm GetHealth.io that exposed 61 million records of wearable health and fitness device users on the internet (see: Researchers: 61M Health IoT Device User Records Exposed).
In 2018, HHS’ Office for Civil Rights signed a US$100,000 HIPAA settlement with Filefax, a defunct Illinois-based medical records storage company, for a 2015 breach involving a Filefax dumpster discovered filled with medical records of about 2,000 patients that should have been shredded or destroyed before disposal.
“Archived systems are occasionally treated differently from production systems, lacking the same day-to-day controls,” Bailey said. “However, this distinction should not undermine their significance, as they still pose potential exposure.”
It is crucial to apply consistent practices to both archived systems and those designated for long-term data storage, demanding identical levels of monitoring and protection as their everyday counterparts, he said. “These systems have to have the same protections in place.”
