Behavioral Health Center

Behavioral Health Center of Bangor, Maine, the covered entity (CE) reported that a hacker accessed the CE’s terminal server and obtained the protected health information (PHI) of 4,229 individuals. The CE reported that the PHI was advertised for sale on AlphaBay, a darknet market place on the Tor Network. The types of PHI included names, services provided and clinical information, addresses, dates of birth, social security numbers and phone numbers. The CE provided breach notification to HHS, affected individuals (including providing one year of triple bureau credit monitoring services), and the media. The CE also contacted the FBI, three consumer reporting agencies, and the Maine Attorney General. As a result of the incident, the CE implemented safeguards that addressed vulnerabilities that were exploited in the incident, disabled a remote server, applied audit controls standards, implemented policies and procedures to guard against malicious software, and adopted an Integrity controls policy. Finally, the CE notified OCR that they were closing their office in 2018.