UNM Health Data Breach Affects More than 637,000 Patients
UNM Health has discovered an unauthorized third party gained access to its network and potentially viewed and exfiltrated files from its systems that contained patients’ protected health information. The security breach was discovered on June 4, 2021 and an investigation was immediately launched to determine the extent and scope of the breach.
UNM Health determined its systems were accessed by the unauthorized third-party on May 2, 2021 and files containing the protected health information of its patients, including those of UNM Hospital, UNM Medical Group, Inc., and UNM Sandoval Regional Medical Center Inc. were potentially compromised.
A comprehensive review of all files on the compromised parts of its network was conducted and it was confirmed they contained information such as names, addresses, dates of birth, medical record numbers, patient identification numbers, health insurance information, and some clinical information related to the healthcare services provided by UNM Health. The Social Security numbers of a limited number of patients were also potentially compromised in the breach. UNM Health said its medical record systems was not affected.
UNM Health started sending HIPAA breach notification letters to all individuals potentially affected by the breach on August 3, 2021. Complimentary credit monitoring and identity theft protection services have been offered to all individuals whose Social Security number was exposed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
UNM Health has not disclosed the exact nature of the security incident but said it has implemented additional measures to improve the security of its systems to prevent similar attacks in the future and has also provided additional education to its workforce on information security.
The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates up to 637,252 patients have been affected by the breach, making this the 19th largest healthcare data breach to be reported so far this year, and the largest ever breach to be reported by a New Mexico healthcare organization.
