Episcopal Health Services – Notice of Data Privacy Event

2019 MAY 29 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- On September 18, 2018 Episcopal Health Services became aware of suspicious activity in employee email accounts. We immediately began an investigation to determine what happened and what information may have been affected. With the assistance of third-party forensic investigators, we determined that certain employee email accounts were subject to unauthorized access between August 28, 2018 and October 5, 2018. These email accounts were then reviewed to determine whether they contained any protected health or personal information. On November 1, 2018, Episcopal Health Services determined that the accounts subject to unauthorized access contained protected health information of certain individuals. Episcopal Health Services is not aware of any reported attempted or actual misuse of any personal information as a result of this event. The types of information contained within the potentially impacted emails are: Social Security number, date of birth, financial account information, medical history information, prescription information, medical record number, treatment or diagnosis information, and health insurance information or policy number. The types of information varied by individual.

On November 15, 2018, Episcopal Health Services began mailing notice letters to individuals whose information was contained within the impacted accounts and for whom they had a postal address. Episcopal Health Services continued reviewing the contents of the impacted email accounts to determine whether they contained any protected information. On February 26, 2019, Episcopal Health Services determined that the additional accounts subject to unauthorized access contained protected information of certain individuals. However, the list of potentially affected individuals provided by the vendor did not include addresses for a large number of individuals and included many potential duplicates. Therefore, Episcopal Health Services was required to review its records to attempt to locate the missing addresses and remove potential duplicates. This process was completed on March 19, 2019. As a result of this continued review, Episcopal Health Services mailed a second round of notice letters to additional individuals whose information was determined to be contained within the impacted email accounts and for whom they had a postal address. Episcopal Health Services has offered potentially impacted individuals access to credit monitoring and identity theft protection services for one year without charge.

(Our reports deliver fact-based news of research and discoveries from around the world.)