HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Sentara Healthcare Informs 5,454 Patients of ePHI Breach

Sentara Healthcare is notifying 5,454 patients that some of their electronic protected health information has been accessed by an unauthorized individual.

It is unclear when the cybersecurity incident occurred, although law enforcement informed Sentara Healthcare of the security breach on November 17, 2016.

Sentara Healthcare launched an investigation into the potential data breach in November and determined that the cybersecurity incident was experienced by one of its third party vendors.

Sentara has not disclosed which vendor was attacked, nor whether the incident was an internal breach involving one of the vendor’s employees or if patient data were accessed by a hacker.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The data breach affects vascular and thoracic patients who received medical services at Sentara Healthcare’s Virginia hospitals between 2012 and 2015.

Patients have been notified of the data breach by mail and have been told that highly sensitive protected health information was inappropriately accessed. The information viewed – and potentially copied – by an unauthorized third party includes patients’ names, Social Security numbers, dates of birth, medical record numbers, demographic information, medications prescribed, and details of procedures that were performed at Sentara Healthcare hospitals.

Sentara Healthcare’s Information Security Team is working closely with its vendor and is assisting law enforcement with its criminal investigation. The data breach investigation is ongoing.

Sentara Healthcare has told patients that it continually assesses and strengthens its policies, procedures, and cybersecurity defenses to ensure that patient data is appropriately protected at all times. Patients have been told that those processes will continue and that the third party vendor concerned will be implementing additional controls to enhance its security defenses to prevent similar incidents from occurring in the future.

All patients impacted by the data breach have been offered 12 months of complementary credit monitoring and identity theft protection services through Experian’s ConsumerInfo.com, Inc., and will receive in-depth assistance if their ePHI are discovered to have been used inappropriately.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.