Hope Health Systems Inc.

Hope Health Systems, Inc. (HHS), based in Woodlawn, Maryland, experienced a significant data breach due to a ransomware attack that was first detected on June 20, 2022. The breach was reported to the U.S. Department of Health and Human Services Office for Civil Rights on November 21, 2022. The investigation into the incident revealed that an unauthorized third party initially accessed HHS’s systems on June 10, 2022, and subsequently encrypted files using ransomware. Although there was no direct evidence of data theft, the possibility could not be ruled out following the forensic investigation concluded around August 24, 2022[1][17].

The data potentially compromised in this breach included sensitive patient information such as names, addresses, dates of birth, Social Security numbers, driver’s license numbers, health insurance information, and medical information. Approximately 9,972 patients were affected by this incident[3][17]. In response to the breach, HHS began notifying impacted individuals on November 21, 2022, and offered credit monitoring and identity protection services to those affected[15].

HHS is a private, for-profit mental health services provider that was founded in 1999. It offers direct mental health, substance abuse, and community support services to adults, children, and minors in both institutional and outpatient settings across three Maryland locations. The company employs over 134 people and generates about $36 million in annual revenue[1].

Following the breach, HHS has been evaluating its cybersecurity policies, procedures, and processes to identify areas for improvement to prevent similar incidents in the future[1][17]. This event underscores the ongoing challenges healthcare providers face in securing sensitive patient information against increasingly sophisticated cyber threats.

Citations:

1. https://www.jdsupra.com/legalnews/hope-health-systems-inc-experiences-6248777/
2. https://www.hipaajournal.com/ransomware-attacks-md-tx-fl/
3. https://stacker.com/maryland/biggest-health-care-data-breaches-you-should-know-about-maryland
4. https://hopehealthsystems.com
5. https://www.sandiegouniontribune.com/news/health/story/2023-11-18/when-ransomware-hits-hospitals-how-do-you-protect-patients-ucsd-researchers-seek-to-make-attacks-less-deadly
6. https://thedailyrecord.com/2022/11/22/hope-health-systems-hit-with-potential-data-privacy-breach/
7. https://mhcc.maryland.gov/mhcc/pages/hcfs/hcfs_con/documents/Filed_2020/con_hope_health_2444_app_20201022.pdf
8. https://oag.ca.gov/privacy/databreach/list
9. https://yaledailynews.com/blog/2023/11/03/details-of-yale-new-haven-healths-attempts-to-acquire-three-prospect-medical-hospitals-go-confidential/
10. https://www.prnewswire.com/news-releases/hope-health-systems-inc-provide-notice-of-data-security-event-301684399.html
11. https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
12. https://windsorstar.com/news/local-news/very-difficult-time-following-hospital-cyberattack-nurses-union
13. https://www.turkestrauss.com/2022/11/28/hope-health-systems-data-breach-investigation/
14. https://www.wusa9.com/article/life/holidays/black-history-month/hope-center-prince-georges-county-mental-health-stigma/65-f72cb812-280a-4612-862a-6715d4fae9cc
15. https://www.mass.gov/doc/assigned-data-breach-number-28610-hope-health-systems-inc/download
16. https://www.kshb.com/news/local-news/patients-at-risk-of-ransom-from-hackers-with-stolen-medical-records
17. https://www.calhipaa.com/phi-possibly-exposed-in-ransomware-attacks-at-hope-health-systems-inc-disability-services-of-the-southwest-and-oceansview-optical/
18. https://canadianbusiness.com/ideas/virtual-clinics-canadas-digital-health-care/
19. https://healthitsecurity.com/news/third-party-data-breach-impacts-119-pediatric-practices-2.2m-patients
20. https://apps.web.maine.gov/online/aeviewer/ME/40/6879b607-b844-41a9-b710-ffcc712a4df4.shtml