Up to 32,000 Patients Impacted by Elizabethtown Community Hospital Email Account Breach
Approximately 32,000 patients of the University of Vermont Health Network’s Elizabethtown Community Hospital are being notified that some of their protected health information (PHI) has been exposed as a result of email account breach.
On October 18, 2018, Elizabethtown Community Hospital discovered an unauthorized individual had gained access to an employee’s email account. The password for the compromised email account was immediately changed and a leading forensic security firm was retained to conduct an investigation into the breach. The investigation, which lasted 60 days, confirmed that a single email account was compromised on October 9, 2018.
The hospital’s information technology systems were not accessed and medical records remained secure at all times. An analysis of the breached email account revealed it contained the PHI of around 32,000 patients. The types of information that were exposed differed from patient to patient and may have included names, addresses, dates of birth, primary information such as medical record numbers, dates of service, summaries of services provided, and limited medical information. The Social Security numbers of 1,200 patients were also exposed.
During the nine days that the account was accessible it is possible that the PHI of patients was viewed or copied, although no evidence of data theft was found. Elizabethtown Community Hospital is unaware of any misuse of patient information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Elizabethtown Community Hospital decided to notify 32,000 patients out of an abundance of caution. The investigation is ongoing, and the breach may be found to have affected fewer patients. Free credit monitoring and identity theft protection services have been offered to all patients whose social security number was exposed.
Elizabethtown Community Hospital has now enhanced the security of its email system and further training has been provided to employees in relation to protecting patient information.
