Chase Olivarius-McAlister reports:
Centura Health – the nonprofit umbrella that owns Mercy Regional Medical Center – has sent letters to about 1,000 people in Durango warning that hackers may have gained access to their personal information.
The potentially compromised information includes patients’ name, Social Security number, Medicare beneficiary number, address, date of birth and phone number as well as clinical information, such as a patient’s diagnosis, date of service, the name of a patient’s treating physician and medical-record numbers.
According to a news release circulated by Centura Health, the hackers may have breached patients’ private information through a sophisticated “phishing” email attack that targeted Centura health employees.
Read more on Durango Herald.
A statement on the medical center’s website, dated April 22, reads:
Notice to our Patients Regarding “Phishing” Incident
04/22/2014Centura Health takes our role of safeguarding patients’ information very seriously. This notice is to inform our patients of a recent incident that may have involved patient information and the actions we took.
On February 11, 2014 Centura Health experienced a “phishing” attack where outside attackers attempted to acquire employee usernames and passwords by posing as a trustworthy source by e-mail. A small group of Centura Health employees responded to the e-mails thinking they were legitimate requests. When we learned of this, we were able to immediately stop the attack and began an investigation. On February 21, 2014 we became aware that a small number of employee e-mail accounts may have been accessible as a result of the phishing. We hired an outside forensics expert firm to perform a comprehensive review of the affected employees’ e-mail accounts and confirmed that some of the e-mails contained patient information and may have included patient demographic information (e.g., name, address, date of birth, telephone number) and/or clinical information (e.g., medical record number, date of service, treating physician, diagnosis), and in some instances Medicare Beneficiary number and Social Security number.
There is no evidence that the information in the emails was ever viewed or used in any way. However, as a precaution, Centura Health began mailing letters to potentially affected patients on April 22, 2014. This incident did not affect all Centura Health patients. We have established a dedicated call center to assist patients with any questions and it will go live on April 22 at 6:00 p.m. Mountain Time. If you believe you have been affected, but have not received a letter by May 12, 2014, please call 1-800-964-1042 Monday through Friday between 7:00 a.m. and 7:00 p.m. Mountain Time.
Centura Health took immediate steps to implement and/or reinforce necessary protective measures to help prevent similar events in the future. Those steps included immediately stopping the attack, performing an investigation and hiring an outside forensics expert to assist, reinforcing education to all employees regarding “phishing” e-mails, and continuing to implement enhancements for strengthening user login authentication. Centura Health has also notified the appropriate authorities.
We deeply regret any inconvenience this may cause our patients.