UPMC began notifying patients Feb. 5 that their protected health information may have been exposed through a data breach at the Pittsburgh-based health system's billing and legal services provider last year.
Charles J. Hilton & Associates launched an investigation into suspicious activity affecting its employee email system last June and found that hackers logged into a number of its employee email accounts between April 1, 2020, and June 25, 2020.
CJHA, which provides billing-related legal services to UPMC, confirmed to the health system in December that some of UPMC's patient information may have been accessed during the breach. UPMC is now alerting more than 36,000 patients that their data was involved; this information included Social Security numbers, birth dates, bank and financial account numbers, medical record numbers and diagnosis details.
CJHA is offering credit monitoring and identity protection services to all individuals who may have been affected by the breach.