◆ Long-term care pharmacy network PharMerica disclosed a breach involving more than 5.8 million patients, making it the largest breach reported to the HHS Office for Civil Rights (OCR) in the last 24 months. According to a privacy incident notice posted on PharMerica’s website, PharMerica and its parent company, BrightSpring Health Services, learned of suspicious activity on their computer network on March 14. The ensuing investigation determined that an unknown third party had accessed PharMerica computer systems from March 12 to March 13 and that “certain personal information may have been obtained as a part of the incident.” On March 21, PharMerica “identified a data population whose personal information and limited medical information (names, dates of birth, Social Security numbers, medication lists and health insurance information) were disclosed.” PharMerica said it has arranged for complimentary identity protection and credit monitoring services for potentially affected individuals.[1]
◆ The Food and Drug Administration (FDA) is warning health care providers and laboratory personnel about a cybersecurity vulnerability affecting the Universal Copy Service (UCS) software in specific Illumina devices designed for gene sequencing. These sequencing devices are used for clinical diagnosis to sequence a person’s DNA for various genetic conditions or in research. According to the FDA, an unauthorized user could exploit the vulnerability by taking control remotely; altering settings, configurations, software or data on the instrument or on a customer’s network; impacting genomic data results in the instruments intended for clinical diagnosis, including causing the instruments to provide no results, incorrect results, altered results or a potential data breach. The FDA noted that it has not received any reports indicating the vulnerability has been exploited. Illumina developed a software patch to protect against the exploitation of this vulnerability, and the FDA is urging providers and laboratory personnel to mitigate the risk immediately.[2]
