Healthcare Resource Group, a revenue cycle management services provider, is notifying patients of Medina, N.Y.-based Orleans Community Health of an email hacking incident that may have exposed patients' personal health information.
HRG, which provides medical billing services for the medical center, on Dec. 31, 2019, discovered that an employee's email account had been accessed by an unauthorized user between Nov. 4 and Nov. 30, according to the news release. A third-party investigation of the incident revealed that certain patient records belonging to Orleans Community Health were present in the account during the time of the unauthorized access.
Patient information potentially exposed includes names, dates of birth, Social Security numbers, medical record numbers, medical billing or claims information, treatment information and driver's license numbers.
HRG notified Orleans about the security incident on March 11. The company said it is unaware of any actual misuse of the personal information as a result of the unauthorized email access.
"HRG takes this incident and security of personal information in its care seriously," the company said in the May 11 news release. "HRG moved quickly to investigate and respond to this incident, assess the security of relevant HRG systems, and notify potentially affected individuals. In response to this event, HRG reviewed and enhanced existing policies and procedures."
HRG is offering free access to one year of credit monitoring and identity theft restoration services to individuals affected by the incident.