ConnectOnCall Announces 914K-Record Data Breach
ConnectOnCall.com – a Delaware-based business associate and Phreesia subsidiary that provides a communication platform for connecting healthcare providers with patients – has suffered a major data breach affecting up to 914,138 individuals.
Healthcare providers use the ConnectOnCall platform to improve their after-hours call process and enhance patient communications. On May 12, 2024, ConnectOnCall identified suspicious activity within its platform and launched an investigation that confirmed that a threat actor had access to the CallOnConnect platform and certain data contained within the application.
Third-party cybersecurity experts were engaged to investigate the security incident and determine the extent of the unauthorized activity. The investigation revealed the threat actor had access to the platform for three months between February 16, 2024, and May 12, 2024.
ConnectOnCall said the platform was immediately taken offline when the security incident was detected, security controls were assessed and enhanced, and the platform was restored in phases in a more secure environment.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The data review confirmed that information shared between healthcare providers and patients through the platform may have been viewed or obtained by the threat actor, including patient names, phone numbers, dates of birth, medical record numbers, health conditions, treatment information, and prescription information. A small subset of individuals may also have had their Social Security numbers exposed.
Phreesia, which acquired ConnectOnCall in October 2023, said the breach was limited to the ConnectOnCall platform, which is separate from all Phreesia systems, including its patient intake platform. Phreesia posted a notice of the security incident on its website on May 15, 2024, three days after the incident was detected; however, it has only recently been confirmed how many individuals were affected.
Individual notification letters were mailed to the affected individuals on December 11, 2024. Individuals whose Social Security numbers were involved have been offered complimentary credit monitoring and identity theft protection services.
