Highlands-Cashiers Hospital

Highlands Cashier Hospital reported to HHS on 2014-12-11 a breach involving unauthorized access or disclosure that affected 26,115 individuals. A business associate, Computer Programs and Systems, Inc., incorrectly configured the hospital's firewall, which exposed patient data on the internet. The exposed information, located on a network server, included patient names, addresses, dates of birth, treatment details, and, for 21,072 individuals, Social Security numbers. In response, the hospital implemented enhanced firewall safeguards, started monitoring web traffic, and began conducting external vulnerability scans.

Highlands-Cashiers Hospital reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2014-11-28. 26 Massachusetts residents were affected. The report records the breach type as electronic.

Highlands-Cashiers Hospital notified the NH AG of a data exposure caused by third-party vendor TruBridge. Servers were inadvertently accessible via the Internet from May 2012 to Sept 2014. Data included patient PII, PHI, SSNs, and employee financial info. 5 NH residents affected. No evidence of actual access found. Credit monitoring offered.