Sunshine Behavioral Health Group LLC

Sunshine Behavioral Health Group, LLC notified the NH AG of a privacy incident where a cloud-based system storing patient records was inadvertently made publicly accessible on the internet. Discovered Sept 4, 2019, the breach affected PHI and payment info of 13 NH residents. Sunshine remediated access controls and offered 2 years of credit monitoring.

Sunshine Behavioral Health Group, LLC notified Montana regulators of a misconfiguration incident where a cloud-based system storing patient records was inadvertently made available on the Internet. The breach affected PHI including SSNs, clinical data, and financial info. Sunshine discovered the incident on September 4, 2019, secured the system, and offered 24 months of credit monitoring.

Sunshine Behavioral Health Group, LLC notified individuals that a cloud-based system storing patient records was inadvertently configured to allow public internet access. The company became aware of the misconfiguration on September 4, 2019, and immediately changed settings and removed records from general access. Affected data included names, addresses, credit/debit card numbers, expiration dates, security codes, and electronic signatures. The company offered 24 months of identity protection services.

Sunshine Behavioral Health Group, LLC reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-01-21. 56 Massachusetts residents were affected. The report records the breach type as electronic.

SUNSHINE BEHAVORIAL HALTH GROUP LLC filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-016). The register records the breach as discovered on December 23, 2019. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

SUNSHINE BEHAVORIAL HALTH GROUP LLC filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-017). The register records the breach as discovered on September 4, 2019. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Sunshine Behavioral Health Group, LLC reported to HHS on 2019-12-02 a Unauthorized Access/Disclosure affecting 3638 individuals. Breached information located on Network Server. A cloud-based system was improperly set up, exposing ePHI including names, SSNs, DOB, and health/financial data.