Cook County Health and Hospitals System Patients Impacted by Experian Health Breach

Cook County Health and Hospitals System, a health system comprising two hospitals and more than a dozen community health centers in Cook County Illinois, has alerted patients to a breach of their protected health information.

The breach occurred at Experian Health, a business associate of Cook County Health and Hospitals System. Experian Health is contracted to determine insurance eligibility and limited patient information is disclosed to the business associate for this purpose.

The breach occurred in March 2017 during an upgrade of Experian Health’s computer system. The protected health information of 727 patients was accidentally sent to other healthcare systems. The PHI disclosed was limited and did not include the types of information sought by cybercriminals to commit identity theft.

Due to the limited disclosure of PHI, and the fact that the information was sent to organizations covered by HIPAA Rules, the risk to patients is believed to be low. To date, Experian Health has not been notified of any unauthorized uses of the disclosed information. The breach was limited to patients’ names, medical record numbers, dates of birth, and account numbers.

Following discovery of the breach, Experian Health took steps to recover and secure the disclosed information and steps have been taken to prevent similar incidents from exposing the PHI of patients. Cook County Health and Hospitals System also reviewed the breach and is satisfied with the actions taken by Experian Health to prevent similar breaches from occurring in the future.

Cook County Health and Hospitals System was notified of the breach on August 1, 2017 and a substitute breach notice was posed on the health system’s website on October 2, 2017. All patients impacted by the breach have now been notified by mail and a breach report has been submitted to the Department of Health and Human Services’ Office for Civil Rights.

Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.