Inmediata Health Group

Inmediata Health Group, Corp reported a data breach to the Oregon Attorney General. The breach was reported on 2019-06-03. The breach occurred during 1/1/2019. The breach was discovered on 1/1/2019. Notice was sent on 4/22/2019.

Inmediata Health Group, LLC (Healthcare Clearing House) reported to HHS OCR on 2019-05-07 an Unauthorized Access/Disclosure affecting 1,565,338 individuals. PHI — including patient names, dates of birth, home addresses, Social Security numbers, claims information, and diagnosis/treatment data — was left publicly accessible on a Network Server and indexed by internet search engines from May 2016 through January 2019. OCR found failures in risk analysis and system-activity monitoring. Inmediata paid a $250,000 settlement; a separate 33-state AG settlement addressed corrective actions.

In January 2019, Inmediata Health Group Corp. discovered that electronic patient health information was publicly accessible online due to a webpage setting that allowed search engines to index pages of an internal website. Data potentially exposed included names, addresses, dates of birth, gender, medical claim information, and in some cases Social Security numbers. The company deactivated the website, engaged a computer forensics firm, and sent notifications in April 2019. No evidence of data misuse or file copying was found.

Inmediata Health Group reported a data breach to the Montana Attorney General. The breach was reported on 2019-04-30. The breach occurred from 1/1/2019 to 1/31/2019. 983 Montana residents were affected.