Rush University Medical Center reveals data breach that may have compromised information of 45,000 patients

Chicago-based Rush University Medical Center revealed it suffered a data breach that may have exposed the personal information of tens of thousands of patients.

In a letter sent to patients, the system said it learned of the breach on January 22, in which an employee of one of its third-party financial services vendors "improperly disclosed a file containing certain patient information to an unauthorized party."

The actual incident was believed to have occurred in May 2018, and law enforcement and regulatory officials were notified.

As of right now, Rush said though the shared information varies by individual, it could include names, addresses, dates of birth, and insurance information. The system investigated and said there was no evidence of any unauthorized access to any of Rush's internal computer systems or network nor was treatment, diagnosis or personal financial information included in the potentially compromised information, according to the letter.

THE IMPACT

According to a report in the Chicago Tribune, 45,000 patients may have been impacted by the breach. The system is offering free identity protection services for one year and is encouraging those who received letters to check their credit reports and monitor all financial accounts for signs of fraud as well as any explanation of benefits statements for unrecognized activity.

THE TREND

The announcement from Rush comes on the heels of major breach announcements from at least two other major systems. UConn Health revealed that on December 24, the system learned an "unauthorized third party" illegally accessed some employee email accounts that contained individuals' names, dates of birth, addresses and limited medical information such as billing and appointment information as well as some Social Security numbers.

Also, UW Medicine said it became aware of vulnerability on a website server that made protected internal files available and visible by search on the internet on Dec. 4, 2018. The files contained patients' names, medical record numbers, and a description and purpose of the information, but did not contain any medical records, patient financial information or Social Security numbers.

ON THE RECORD

"Rush takes this matter very seriously. After our discovery of the incident, we launched an internal investigation and suspended our contract with the financial claims vendor. Additionally, we are reviewing our internal procedures and contracting processes to help prevent this type of incident from happening in the future. We are also increasing our internal awareness of service vendors and reviewing processes for working with third-party firms," Rush said in the letter.

Twitter: @BethJSanborn
Email the writer: beth.sanborn@himssmedia.com