Approximately 160,000 patients were affected by a data breach at Bowling Green, Ky.-based Med Center Health, according to a Daily News report.
The data breach occurred after a former MCH employee obtained billing information involving patients treated at multiple organization facilities between 2011 and 2014. The stolen information included names, addresses, social security numbers, health insurance information, diagnosis and procedure codes and charges for medical services, MCH said in a news release. No patient medical records were affected.
MCH said it initially learned of the data breach in January during an internal investigation. However, the organization delayed publicly announcing the incident at the request of law enforcement.
Commenting on the delay, the organization said: "Med Center Health informed patients as expeditiously as possible. It is important to understand that the information leading Med Center Health to report the incident pursuant to HIPAA developed over time during an intensive internal investigation," according to the report.
MCH added: "Indeed, our internal investigation is ongoing and information is actively being developed and provided to law enforcement. Nonetheless, once we believed we had gathered adequate information to support that a HIPAA-related incident occurred, we followed the appropriate processes. We have no current information indicating the patient information was used for fraud. Our goal throughout this process is to be open and transparent and share information as quickly as possible, while at the same time not hindering law enforcement."
MCH said it will offer free credit monitoring and identity protection services for one year to patients affected by the data breach. The cost of the data breach will be based on how much that offer is utilized, the organization told Daily News.