NEWKIRK Oklahoma

Symphonix Health, a healthcare services provider, reported a cybersecurity incident involving its third-party vendor, Newkirk Products, Inc. On May 21, 2016, unauthorized access occurred to a server containing member information. The breach exposed names, addresses, dates of birth, and plan details, but explicitly excluded SSNs, banking info, or medical records. Newkirk shut down the server, engaged forensic investigators, and notified law enforcement. Affected members were offered two years of identity protection services.

Newkirk Products, Inc. filed a data breach notification with the California Attorney General. The breach occurred on May 21, 2016. The provided source document contains only the filing metadata and an empty attachment placeholder; no narrative details regarding the nature of the breach, data types affected, or number of individuals impacted are available in the text.

Newkirk Products, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2016-08-17. The breach occurred during 5/21/2016. The breach was discovered on 7/6/2016. 3,466,120 individuals were affected. Notice was sent on 8/8/2016.

Newkirk Products, Inc. (NY), a business associate issuing member healthcare ID cards, reported to HHS OCR on 2016-08-09 a Hacking/IT Incident affecting 3,466,120 individuals. Prior to its acquisition by a new parent company, unauthorized individuals accessed a network server containing ePHI of ~3.99M health plan members. Exposed data included names, addresses, plan/group/member IDs, dependent names, primary care provider, and in some cases Medicaid IDs, dates of birth, and premium invoice information. The former parent decommissioned the server; a new IT environment was established. OCR required a risk analysis, remediation plan, and updated HIPAA policies.