Malicious Actor Steals Patient Data from Multiple Ernest Health Hospitals

Posted By Steve Alder on Apr 3, 2024

Ernest Health, the operator of rehabilitation and long-term acute care hospitals in Arizona, California, Colorado, Idaho, Indiana, Montana, New Mexico, Ohio, South Carolina, Texas, Utah, Wisconsin, and Wyoming, has started notifying patients about a recent data security incident involving their personal and protected health information.

Ernest Health identified unauthorized activity in its computer systems on February 1, 2024, and the forensic investigation confirmed there had been unauthorized access to systems containing patient data between January 16, 2024, and February 4, 2024, and files were acquired in the attack that included patient information. For the majority of the affected individuals, the compromised data was limited to names, addresses, dates of birth, medical record numbers, health insurance plan member IDs, claims data, diagnosis, and prescription information. Some patients also had their Social Security and/or driver’s license numbers compromised.

The security incident affected patients at multiple hospitals in the network, including:

Notification letters started to be mailed to the affected individuals on March 29, 2024, and complimentary credit monitoring and identity theft protection services have been offered for two years. The data breach has been reported to regulators, and based on the breach reports that are currently showing on the HHS’ Office for Civil Rights breach portal, at least 101,413 individuals have been affected.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy