Saltzer Health Alerts Patients About PHI Exposure in Email Account Breach
Nampa, Idaho-based Saltzer Health has started notifying certain patients that some of their protected health information (PHI) has been exposed in an email account breach that was detected on June 1, 2021.
The investigation revealed an unauthorized individual had access to an employee’s email account between May 25, 2021, and June 1, 2021. Saltzer Health was unable to find evidence indicating the attacker viewed or exfiltrated emails from the account, but it was not possible to rule the possibility of unauthorized PHI access and data theft.
The investigation confirmed the breach was confined to a single email account and no other systems were affected. Assisted by third-party specialists, Saltzer Health conducted a comprehensive review of the email account to determine which patients had been affected.
The review was completed on September 21, 2021, and revealed the following types of patient data were stored in the account: Names, contact information, state identification numbers, driver’s license numbers, medical record numbers, medical histories, diagnoses, treatment information, physician information, prescription information, and health insurance information, along with limited Social Security numbers and financial account information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Once the affected patients were identified, Saltzer Health conducted a manual review of internal records to verify patients’ contact information, hence the delay in issuing breach notification letters until December.
Saltzer Health has provided affected patients with information about the steps they can take to guard against identity theft and fraud, but there is no mention in the substitute breach notice about the provision of credit monitoring or identity theft protection services.
The breach has been reported to the Department of Health and Human Services’ Office for Civil Rights, but it has yet to appear on the OCR breach portal, so it is currently unclear how many patients have been affected.
