Revenue Cycle Management Firm Hack Affects Patients, Clients

A Nebraska-based firm that provides revenue cycle management and billing services to healthcare firms is notifying tens of thousands of people and an undisclosed number of companies that their personal, health and financial information was compromised in a March 2024 hack.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

ALN Medical Management, which was acquired in 2023 by Maryland-based Health Prime, first reported the breach to federal regulators in May 2024 as a hacking incident affecting 501 people – a placeholder estimate. As of Friday, the U.S. Department of Health and Human Services HIPAA Breach Reporting Tool website listing major health data breaches did not appear to contain an updated report from ALN.

But in recent days, ALN has filed breach reports with several state attorneys general. That includes a report filed to Texas regulators on March 24 saying that the company’s hack affected 127,113 Texans.

Breach reports ALN also filed to several other states so far, including California and New Hampshire, do not contain figures for the number of people affected in those states.

But some experts suspect the total number of people – as well as clients using ANL’s services – affected by the incident could be vast.

“ALN Medical provides revenue cycle management, medical billing, collections and IT services to physicians and clinics. They manage records detailing the financial and medical characteristics of patients and also have access into the networks of their customers,” said Mike Hamilton, field CISO at security firm Lumifi Cyber.

“Depending on the length of time the threat actor was in the ALN network, they may have obtained information on credentials used to access those networks. If true, this would provide continuing access and possibilities for further records theft and extortion to a broad swath of healthcare organizations.”

Breach reports ALN submitted to state regulators indicate that information affected by the incident includes names, Social Security numbers, driver’s license numbers, government-issued ID numbers such as passports or state ID cards, financial information such as account numbers, credit or debit card numbers, medical information and health insurance information.

ALN in its breach notice said that in March 2024, it identified suspicious activity related to certain systems being hosted by an unnamed third-party service provider.

“Upon learning of this activity, we promptly took steps to ensure the security of our systems, isolated the impacted environment and launched an investigation to determine the nature and scope of the activity,” ALN said.

ANL’s investigation found that some files and folders within its third-party hosted environment were accessed or taken by an unauthorized actor between March 18, 2024, and March 24, 2024. “This incident did not impact internal ALN systems,” the company said.

Lawsuits Begin

As of Friday, ALN was already facing at least three proposed federal class action lawsuits involving the breach – and several other class action law firms had also issued public notices in recent days saying that they too are investigating the ALN incident for potential litigation.

One of the complaints already filed against ALN – by plaintiff Cameron Reed on behalf of herself and others similarly situated – alleges a variety of failures by ALN, including negligence, breach of contract and other claims. Reed’s lawsuit, like the others filed so far, seek relief including financial damages as well an injunctive order for ALN to improve its data security practices.

“Healthcare providers must have effective revenue cycle management,” said regulatory attorney Paul Hales of the Hales Law Group, who is not involved in the ALN lawsuits. “The ALN breach is another illustration of problems that can arise when working with RCM vendors,” he said.

“Invariably, protected health information entrusted to an RCM vendor is distributed to subcontractors that perform various RCM services. ALN faults a third-party service provider for the breach,” he said.

Of course, there have been other such incidents involving vendors that provide revenue cycle management and related services – including the massive February 2024 ransomware attack on Change Healthcare.

“These vendors are a jackpot for attackers because of the blend of personal, health and financial data they manage,” said Eran Barak, co-founder and CEO at security firm MIND. The combination of data that can be compromised in these sorts of hacks “enables everything from identity theft to insurance fraud, which is why threat actors see RCM providers as high-value targets,” he said.

The continuing pattern of compromising third parties that serve healthcare and other sectors must not be ignored, Hamilton said. “This is an opportunity to work with vendors and cooperatively game-out scenarios that can have broad impact and develop contingencies.”

Hales suggests that healthcare providers thoroughly vet RCM vendors through careful due diligence and business associate agreements, “and ensure that their vendors require comparable due diligence and BAAs at every link of the chain, regardless of its length.”

Health Prime – ALN’s parent company – did not immediately respond to Information Security Media Group’s request for comment and additional details about the ALN breach.