Frederick Regional Health System recently disclosed a phishing incident that compromised an undiclosed number of hospice patients’ personal and protected health information. Here is their notification, first reported by the Frederick News-Post.
Frederick Regional Health System is committed to protecting the security and confidentiality of our patients’ information. Regrettably, this notice is to inform our Hospice patients of an incident involving some of that information.
On January 21, 2019, we learned that an unauthorized person gained access to an employee’s email account via phishing. We immediately secured the account and began an investigation. The investigation determined that some Hospice patient information was contained in the account, which may have included patient names, types of health insurance, health insurance numbers, and in some instances, Social Security numbers.
This incident did not affect all Frederick Regional Health System patients or all Hospice patients; only certain patients receiving Hospice services from June 2017 to January 2019 are affected.
We have no indication that any patient information has been misused. However, in abundance of caution, we mailed letters to affected patients on March 18, 2019 and established a dedicated call center to answer any questions our patients may have.
If you believe you were affected by the incident and do not receive a letter by April 11, 2019, please call 1-844-582-5075, Monday through Friday, 8:00 a.m. to 5:00 p.m. We recommend that affected patients review the statements they receive from their health insurers. If they see services they did not receive, they should contact the insurer immediately. For eligible patients, we are offering a complimentary one-year membership of credit monitoring and identity protection services.
We deeply regret any inconvenience or concern this incident may cause our patients. Frederick Regional Health System has dedicated multiple resources to Cyber Security over the years because we know the healthcare industry is a target. We will continue to implement additional security enhancements and conduct further email training with our staff.