On June 10, 2024, Signature Performance, Inc. reported a data breach affecting 106,540 UNC Health Southeastern patients. The breach compromised sensitive information, including names, addresses, medical records, and more.
Nebraska-based business associate Signature Performance Inc. detected unauthorized access to confidential consumer data between January 17 and 18, 2024.
The breach exposed patients' sensitive information, including names, addresses, phone numbers, Social Security numbers, medical records, Medicare/Medicaid IDs, and health insurance details. In response, the company launched an investigation and promptly began notifying affected individuals through data breach notification letters.
According to Signature Performance's notification letters, “In response to this incident, Signature notified law enforcement and implemented additional security measures to further minimize the risk of a similar incident occurring in the future.”
Signature then reassures affected patients, stating that “While Signature has no reason to believe any of the information described above has been misused, in an abundance of caution, Signature is providing you with access to Single Bureau Credit Monitoring/Credit Report/Credit score services at no charge.”
Furthermore, “Signature is providing you with proactive fraud assistance to help with any questions that you might have or in event that you become a victim of fraud,” through Cyberscout fraud assistance and remediation services.
According to HIPAA regulations, a business associate is defined as an individual or entity responsible for performing specific functions or providing services on behalf of a covered entity (healthcare provider, health plan, or healthcare clearinghouse).
Healthcare providers, like UNC Health Southeastern, often depend on business associates to handle tasks involving protected health information (PHI). As a business associate, Signature Performance manages large-scale healthcare data and is obligated to implement technical safeguards to protect PHI from unauthorized access and data breaches.
Go deeper: What does it mean to be a business associate?
Business associates must enhance their cybersecurity measures and ensure compliance with HIPAA regulations, mitigating the risk of potential data breaches. Additionally, affected individuals should take proactive steps to monitor their financial accounts and take advantage of the fraud assistance offered.
Related: HIPAA Compliant Email: The Definitive Guide