More than 1,000 Essential Health Patients Impacted by Nemadji Research Corporation Breach

Essentia Health, an integrated health system serving Minnesota, Wisconsin, North Dakota, and Idaho, is sending notifications to more than 1,000 patients alerting them to the exposure of some of their protected health information (PHI).

Like many healthcare providers, Essentia Health works with a third-party vendor that provides billing services to help recover lost revenue. Those services were provided by a Bruno, MN-based billing services firm called Nemadji Research Corporation.

Essentia Health provided Nemadji with certain types of PHI to allow the company to perform its contracted services. Essentia Health did not disclose exactly what types of information were exposed in the substitute breach notice posted on its website.

On March 28, 2019, Nemadji discovered unusual activity in an employee’s email account. The investigation revealed the employee had fallen for a phishing scam and had disclosed login credentials to the attacker. The account was subjected to unauthorized access for a period of several hours before the account was deactivated.

The subsequent investigation revealed the email account contained the PHI of patients of some of its clients. The L.A. Times had previously reported that the phishing attack had exposed the PHI of 14,591 Los Angeles Department of Health Services (DHS) patients. The latest report from Essentia Health shows the breach was more widespread.

The incident has been reported to the Department of Health and Human Services’ Office for Civil Rights breach portal. The breach report indicates 1,377 patients were impacted by the breach. Nemadji Research Corporation has also submitted a separate breach report to OCR under the business name of California Reimbursement Enterprises, which shows a further 14,591 individuals were affected.


Author: Steve Alder has many years of experience as a journalist, and comes from a background in market research. He is a specialist on legal and regulatory affairs, and has several years of experience writing about HIPAA. Steve holds a B.Sc. from the University of Liverpool.