More than 1,000 Essential Health Patients Impacted by Nemadji Research Corporation Breach
Essentia Health, an integrated health system serving Minnesota, Wisconsin, North Dakota, and Idaho, is sending notifications to more than 1,000 patients alerting them to the exposure of some of their protected health information (PHI).
Like many healthcare providers, Essentia Health works with a third-party vendor that provides billing services to help recover lost revenue. Those services were provided by a Bruno, MN-based billing services firm called Nemadji Research Corporation.
Essentia Health provided Nemadji with certain types of PHI to allow the company to perform its contracted services. Essentia Health did not disclose exactly what types of information were exposed in the substitute breach notice posted on its website.
On March 28, 2019, Nemadji discovered unusual activity in an employee’s email account. The investigation revealed the employee had fallen for a phishing scam and had disclosed login credentials to the attacker. The account was subjected to unauthorized access for a period of several hours before the account was deactivated.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The subsequent investigation revealed the email account contained the PHI of patients of some of its clients. The L.A. Times had previously reported that the phishing attack had exposed the PHI of 14,591 Los Angeles Department of Health Services (DHS) patients. The latest report from Essentia Health shows the breach was more widespread.
The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights breach portal. The breach report indicates 1,377 patients were impacted by the breach. Nemadji Research Corporation has also submitted a separate breach report to OCR under the business name of California Reimbursement Enterprises, which shows a further 14,591 individuals were affected.
