{"id":570,"date":"2023-04-18T06:27:10","date_gmt":"2023-04-18T11:27:10","guid":{"rendered":"https:\/\/kentprotect.com\/?p=570"},"modified":"2023-04-20T22:32:05","modified_gmt":"2023-04-21T03:32:05","slug":"breach-report-alcohol-recovery-startup-monument-breaches-health-records-for-over-108000-individuals-over-3-years-via-advertising-pixels","status":"publish","type":"post","link":"https:\/\/kentprotect.com\/index.php\/2023\/04\/18\/breach-report-alcohol-recovery-startup-monument-breaches-health-records-for-over-108000-individuals-over-3-years-via-advertising-pixels\/","title":{"rendered":"Breach Report: Alcohol recovery startup Monument breaches health records for over 108,000 individuals over 3 years via advertising pixels"},"content":{"rendered":"
<\/div>\n

*<\/p>\n\n\n\n

(image source: Monument (Verywellmind), n.d.)<\/p>\n\n\n\n

One-sentence summary: <\/strong><\/p>\n\n\n\n

Monument, an NYC-based alcohol recovery startup, potentially breached the protected health information of over 108,000 individuals over 3 years (and an additional 3 years retroactively via Tempest) via advertising pixels. <\/p>\n\n\n\n

Who was involved?<\/strong><\/p>\n\n\n\n

Monument, Inc., its subsidiary Tempest, and 108,584 individuals. <\/p>\n\n\n\n

What was the timeline?<\/strong><\/p>\n\n\n\n

November 2017: Breach starts with Tempest members<\/p>\n\n\n\n

January 2020: Breach starts with Monument members<\/p>\n\n\n\n

December 1, 2022: HHS publishes a privacy guidance bulletin regarding advertising, including advertising pixels (HHS, 2022). Monument claims to receive notice around this time and begins an internal investigation as well as the cessation of such advertising methods. <\/p>\n\n\n\n

February 6, 2023: Monument determines it has breached PHI via advertising<\/p>\n\n\n\n

February 23, 2023: Monument confirms it has removed all offending advertising services from service. <\/p>\n\n\n\n

March 31, 2023: Monument reports the breach to HHS and presumably begins public notification<\/p>\n\n\n\n

What occurred?<\/strong><\/p>\n\n\n\n

Monument, an alcohol recovery startup, used advertising pixels along with its subsidiary (Tempest) since 2020 and 2017, respectively, unknowingly breaching the protected health information of over 108,584 individuals, which may have included: “name, date of birth, email address, telephone number, address, Monument ID, insurance member ID, IP address, unique digital ID, Uniform Resource Locator (URL), photograph, selected services or plan, assessment or survey responses, appointment-related information, and associated health information” (Monument, 2023; HHS, 2023). Monument claims to have received warning from HHS’s bulletin back in December 2022 covering advertising pixels, thus initiating their investigation (Monument, 2023; HHS, 2022). <\/p>\n\n\n\n

Estimated costs:<\/strong><\/p>\n\n\n\n

Associated incident response costs, breach notification costs, potential identity monitoring services, M-F call center<\/p>\n\n\n\n

Involved laws: <\/strong><\/p>\n\n\n\n

Federal: HIPAA and HITECH <\/p>\n\n\n\n

California: CCPA and Cal. Civ. Code \u00a7 1798.29(a)<\/p>\n\n\n\n

Root cause: <\/strong><\/p>\n\n\n\n

Voluntary business practices and\/or misconfiguration: advertising technologies.<\/p>\n\n\n\n

Lessons learned: <\/strong><\/p>\n\n\n\n

Theoretically, in-house and independent risk and GRC assessments on advertising practices may allow an organization to preemptively respond to or prevent breaches, even before specific regulatory clarification occurs (e.g., HHS guidance publications). Thorough compliance audits and privacy assessments. Another paradigm: assessing risk with established data flows in the enterprise (advertising is an outbound data flow and, therefore, a potential privacy risk). Breaches continue to occur at major corporations due to voluntary misconfiguration and, therefore, necessitate the need for regular, rigorous auditing.<\/p>\n\n\n\n

Sources: <\/strong><\/p>\n\n\n\n

HHS. (2022). Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates. In U.S. Department of Health & Human Services<\/em>. Office for Civil Rights (OCR). Retrieved April 18, 2023, from https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/guidance\/hipaa-online-tracking\/index.html<\/p>\n\n\n\n

HHS. (2023). Cases Currently Under Investigation. In Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information<\/em>. U.S. Department of Health and Human Services Office for Civil Rights. Retrieved April 18, 2023, from https:\/\/ocrportal.hhs.gov\/ocr\/breach\/breach_report.jsf<\/p>\n\n\n\n

Monument. (2023). Monument – Sample Notification Letter 4888-3653-0266 v.2.pdf. In Submitted Breach Notification Sample<\/em> (AI4831 v.01). Rob Bonta California Attorney General. Retrieved April 18, 2023, from https:\/\/oag.ca.gov\/ecrime\/databreach\/reports\/sb24-564977<\/p>\n\n\n\n

Monument (Verywellmind). (n.d.). Monument-Recirc-aa8c55b799424c8193f9bbc8b5e4a57c.jpg<\/em>. Verywellmind. https:\/\/www.verywellmind.com\/thmb\/wysdvUsebhoseRDDmYBgEkYFsD0=\/1500×0\/filters:no_upscale():max_bytes(150000):strip_icc()\/Monument-Recirc-aa8c55b799424c8193f9bbc8b5e4a57c.jpg<\/p>\n\n\n\n

Commentary: <\/strong><\/p>\n\n\n\n

This breach report mimics another healthcare startup breach previously covered, Cerebral<\/a>, and may foreshadow an increasing number of healthcare breach reports due to more specific HHS guidance.<\/p>\n\n\n\n

\n