Email Account Hack Affects 25,000 Adirondack Health Patients
Vermont-based Adirondack Health is notifying approximately 25,000 patients that some of their protected health information has potentially been obtained by a hacker.
The information may have included patients’ names, dates of birth, Medicare ID numbers or health insurance member numbers, and limited treatment and/or clinical information. A subset of patients also had their Social Security number exposed.
Adirondack Health is part of Adirondacks Accountable Care Organization (ACO), which includes various different healthcare providers. For monitoring purposes and to help improve the quality of services provided to patients, ACO receives and analyzes certain patient information.
ACO recently discovered an unauthorized individual had gained access to the email account of an employee. The breach was detected on March 4, 2019 and the account was immediately secured. The hacker had access to the account for a period of two days.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
ACO checked every email and attachment in the compromised account to determine whether any PHI had been exposed. There was only one item in the compromised account that included private information: An email discussion about patients in the North Country who missed a baby health screening appointment.
The conversation related to an ACO population health analysis. Attached to the email was a ‘gap-in-care’ spreadsheet that contained PHI. No evidence was uncovered which suggested the email was opened, but the possibility could not be ruled out.
Breach notification letters were sent to affected patients in early July, but it has taken some time to verify some patients’ current addresses. Approximately 25,000 letters have now been sent and only a few remain.
Patients whose Social Security number was exposed have been offered complimentary credit monitoring and identity theft protection services. All patients have been advised to monitor their financial accounts and explanation of benefits statements and to be alert to the risk of fraudulent use of their information.
A spokesperson for Adirondack Health said the email account was accessed remotely by an individual outside the United States. The account breach was not due to a phishing attack.
Adirondack Health has since updated its policies and procedures regarding the use of email for communicating files containing PHI.
