CaptureRx, a 340B administrative services provider to healthcare organizations in San Antonio, TX, has experienced a ransomware attack that resulted in the theft of files that contain the protected health information (PHI) of its customers’ patients.
The provider discovered the security breach on February 19, 2021. An investigation into the breach confirmed that unauthorized people got access to files that contain sensitive information on February 6, 2021. An analysis of those files was accomplished on March 19, 2021 and impacted healthcare company clients were informed from March 30 to April 7, 2021.
Since the incident, CaptureRx has been working together with the impacted healthcare companies to inform all people impacted by the breach. The types of information compromised and obtained by the attackers only included names, birth dates, and prescription data. For a few patients, their medical record numbers were also compromised.
CaptureRx had set up security systems to protect that the privacy and security of healthcare information, however, the attackers still were able to get around those defenses. Right after the attack, the provider reviewed and improved its policies and procedures. The workforce also received additional training to minimize the risk of any more security breaches.
It is presently uncertain how many of the healthcare company clients of CaptureRx were impacted nor the exact number of people affected by the breach. The healthcare providers affected by the breach include:
- Faxton St. Luke’s Healthcare in New York, a Mohawk Valley Health System affiliate, has 17,655 patients.
- Thrifty Drug Stores (Thrifty White) has an unknown number of patients at present.
- Gifford Health Care in Randolph, VT has 6,777 patients.
CaptureRx stated the breach investigators did not find any proof that indicates any actual or attempted improper use of the stolen data; nonetheless, the affected individuals are instructed to keep track of their account and explanation of benefits statements for indications of fraudulent transactions.