eye care 1

Eye Care EHR System Hacked

Updated June 29, 2022

Another business associate has been hacked and the number of healthcare providers affected, and their patients keeps growing.

So far, more than 1.5 million individuals have been affected by the hack of an electronic health record (EHR) vendor that serves vision care providers across the country. Eye Care Leaders, based in Durham, North Carolina, offers practice management and health records software services for ophthalmologists, optometrists and opticians. The cloud-based system affected by the hack is myCare Integrity.

On its website, Eye Care Leaders states:

“Trusted by more than 9,000 ophthalmologists and optometrists, Eye Care Leaders is the No. 1 source for top-rated ophthalmology-specific EHR and Practice Management systems.”

Eye care providers have been subject to cybersecurity hacks over the past couple of years, affecting over six million individuals.

As of  June 29, 2022, the Office for Civil Rights had listed twenty-four providers affected, and over 1.5 million patients.

The following six eye care health care providers were the earliest ones to have reported breaches to either the HHS’ Office for Civil Rights (OCR) or the Maine attorney general’s office.

  • Ad Astra Eye LLC, of Kansas reported to OCR on April 29 that 3,684 individuals had been affected;
  • Frank Eye Center, P.A., of Kansas reported to OCR on April 29 that 26,333 individuals had been affected;
  • Regional Eye Associates Inc. of West Virginia reported to OCR on April 28 that 194,035 individuals had been affected;
  • Tennessee-based Summit Eye Associates reported to OCR on April 27 that nearly 54,000 individuals had been affected;
  • Washington state-based King County Public Hospital District No. 2 – doing business as Evergreen Health – reported to OCR on April 22 that nearly 21,000 individuals had been affected;
  • Ohio-based Allied Eye Physicians & Surgeons Inc. reported to the Maine attorney general’s office on April 27 that an “external hacking” incident had affected nearly 21,000 individuals.

Cyberattacks on business associates are especially damaging because business associates hold so much protected health information (PHI) from all of their customers. As this most recent attack was only discovered in March, the investigation is still ongoing and the number of individuals affected will likely grow.

EHR Systems are Vulnerable

In February, HHS’ Health Sector Cybersecurity Coordination Center issued a warning about cybersecurity threats involving EHRs and EMRs, noting that the such data compromises are profitable to cybercriminals for extortion, fraud, identity theft, data laundering and sale on the dark web.

So far in 2022, at least 12 major breaches affecting more than 355,800 individuals have been posted on the OCR breach reporting tool as involving EHRs, for all types of healthcare providers.

Business Associate Due Diligence

Although a business associate is separately liable for HIPAA compliance, healthcare providers that enter contracts with them are still responsible for evaluating whether their business associates are truly compliant. Business associate due diligence requires looking beneath the surface – asking questions and asking for proof of compliance.

Eye Care Leaders promotes itself as “HIPAA compliant” and notes that all of its EHR products have been certified under the HITECH Act’s HHS Office of the National Coordinator of Health IT’s health IT certification program. But a certification from the ONC is not the same as HIPAA compliance.

When a breach occurs at a business associate, the healthcare providers who engaged them are not necessarily off the hook. When OCR investigates the business associate breach, they will also ask questions of the providers the business associate served. Before entering a business associate agreement, providers need to verify, for example, that business associates perform HIPAA Risk Analysis at least annually, that they have HIPAA policies and procedures in place.

Evaluate your business associates (or subcontractor BAs) and ask questions. If you need help understanding third party vendor (and business associate) risk management, we can help.

Share This Post

Maggie Hales

Maggie Hales is a lawyer focusing on health information privacy and security. As CEO of ET&C Group LLC she advises health care providers and business associates in 36 states, Canada, Egypt, India and the EU, using The HIPAA E-Tool® to deliver up to date policies, forms and training on everything related to HIPAA compliance.

Copyright © 2023 ET&C Group LLC.

The HIPAA E-Tool® and Protecting Patient Privacy is Our Job® are registered trademarks of ET&C Group LLC

Terms & Conditions | Privacy Policy | Cookies Policy | Privacy Settings

Mailing Address
The HIPAA E-Tool
PO Box 179104
St. Louis, MO 63117-9104

8820 Ladue Road Suite 200
St. Louis, MO 63124