Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Breach topic
No spam. Unsubscribe anytime.
DPH compliance director describes Nuance transcription breach that affected ZSFG and Laguna Honda
Summary
The Department of Public Health told the Health Commission a former Nuance employee was arrested after unauthorized access to a transcription platform; DPH notified roughly 893 employees and patients and delayed public notification at DOJ request while federal investigators recovered an external hard drive.
The San Francisco Department of Public Health told the Health Commission that a security incident involving a third-party transcription vendor, Nuance Communications, affected staff at Zuckerberg San Francisco General Hospital and Laguna Honda.
“Maggie Costa” said DPH received preliminary notification on Dec. 22, 2017, that a former Nuance employee had accessed and downloaded data from one of Nuance’s platforms. She said federal law enforcement recovered an external hard drive kept in a secure storage area, and that the former employee has been arrested. “The US Attorney’s Office has stated that the government has no indication that this former employee either used, sold, or otherwise transferred the data,” Costa said.
Costa told commissioners Nuance notified the FBI and the Department of Homeland Security and retained CrowdStrike to assist with forensic analysis. The Department of Justice requested that DPH delay notifications to affected individuals so as not to impede the criminal investigation; DPH notified patients on the Friday before the meeting once permitted to do so.
DPH said 893 department employees were affected, and that patient fields involved included patient name, date of birth, medical record number, date of transcription and the transcribed notes. Nuance has concluded there is a low probability that protected health information was compromised and has migrated the data to a new secure web-based application, staff said.
Director Garcia said DPH IT reviewed forensic reports and has ongoing vendor-security reviews and business agreements with subcontractors. Costa said the department’s IT director participated in the investigation and that agency staff have maintained extensive communications with Nuance during the inquiry.
DPH did not provide a timeline for any remedial measures beyond migration to a secure system and said it will continue coordinating with federal investigators. The department also notified the California Department of Public Health and the state Attorney General’s office because the incident involved more than 500 patients, as required by state reporting practices.
