Philips Data Breach Exposes Patients To Medicare Fraud

In mid-2023, Philips was notified of a security vulnerability that affected Care Orchestra and Encore Anywhere, the two patient management platforms used by clinicians and DME's to monitor patients remotely and bill insurance providers for supplies etc.

After a lengthy investigation, Philips found that hackers had indeed exploited the vulnerability and accessed the database that included your name, address, date of birth, email address, phone number, patient ID, facility ID, device serial number, modem serial number, physician and device usage.

They have not mentioned that medical insurance information was accessed; however, when you enter a patient's personal details into Care Orchestra, you also enter all that insurance information and although I'm not an expert, i find it very hard to believe that they encrypted that information but failed to encrypt the personal data etc. It's only speculation I know. However, this is Philips.

[cardinalflower]

Just when you think it can't get any worse . . . .

[sirenmuscle]

So glad I chose resmed 3 yrs ago when given a choice without any help over Phillips. Dodged a bullet.

[danb.]

Thanks for your continued follow-ups on the Philips saga! It's definately a good idea to get the word out to keep an eye out for any kind of insurance fraud.

That said, and not looking to defend Philips, but 2:00 - not necessarily. With a large infrastructure it wouldn't be uncommon for financial data to be stored seperate from a server hosting the data described in the breach, the screenshot in your example could be on a seperate database (and server/cluster) from the one that was breached.

The reasons for different servers - when operating at scale you often don't want the same server thats getting hammered by the cpap submitting logs to be the same server thats also serving up the web application data, and also the same server that's running billing reports... So, you segregate the data out to different servers and only replicate whats needed for that particular server and the applications connecting to it to operate - it also helps from a security standpoint by compartmentalizing the data (the person billing you has no need to see your AHI score last night, and the doctor shouldn't need to know how Philips is billing you, so why even have the data on servers they can access). If I were to take a shot based on the disclosure text, it sounds like the compromised DB isthe one that makes the device logs available to the doctors - but they could also be omitting the true extent.

[tinakondo]

Between this and recalled machines I think they should be shut down and long with any supplier that knew there was a problem with their machines.

[lockpickingengineer]

This is why we need to go back to fax machines!

[HeadroomPR]

Well, incidentally I received today Phillips letter warning me about this breach, but since I've never used any online data system I think am not really in any danger🤷🏽‍♂️

[Lvemylife]

I know I have mail from them. I have in my mailbox, this is how I found you.

[ayianaarthur]

I have a phillips dreamstation (not dreamstation 2) from the hospital on loan for free as I can’t afford to buy one. I feel like I’m putting my health at risk using it. Is it safe to use?

[ghatmen]

As someone who has created over 1000 of said accounts, would never bother putting in the insurance info too much else to do lol so I guess that’s a good thing.

[jeffreyjourdonais]

You have to keep track of all your medicare's notices and make sure it was yours, also you gap plan as well.

[frankrinaldi]

And what about medicare not anything different. We had to get new ID cards