Cook County Health and Hospitals System Patients Impacted by Experian Health Breach
Cook County Health and Hospitals System, a health system comprising two hospitals and more than a dozen community health centers in Cook County Illinois, has alerted patients to a breach of their protected health information.
The breach occurred at Experian Health, a business associate of Cook County Health and Hospitals System. Experian Health is contracted to determine insurance eligibility and limited patient information is disclosed to the business associate for this purpose.
The breach occurred in March 2017 during an upgrade of Experian Health’s computer system. The protected health information of 727 patients was accidentally sent to other healthcare systems. The PHI disclosed was limited and did not include the types of information sought by cybercriminals to commit identity theft.
Due to the limited disclosure of PHI, and the fact that the information was sent to organizations covered by HIPAA Rules, the risk to patients is believed to be low. To date, Experian Health has not been notified of any unauthorized uses of the disclosed information. The breach was limited to patients’ names, medical record numbers, dates of birth, and account numbers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Following discovery of the breach, Experian Health took steps to recover and secure the disclosed information and steps have been taken to prevent similar incidents from exposing the PHI of patients. Cook County Health and Hospitals System also reviewed the breach and is satisfied with the actions taken by Experian Health to prevent similar breaches from occurring in the future.
Cook County Health and Hospitals System was notified of the breach on August 1, 2017 and a substitute breach notice was posed on the health system’s website on October 2, 2017. All patients impacted by the breach have now been notified by mail and a breach report has been submitted to the Department of Health and Human Services’ Office for Civil Rights.
