Arlington-based Texas Health Resources is notifying about 4,000 patients who received care in 2017 that their protected health information may have been breached when an unauthorized third party potentially gained access to some employees' email accounts.
In January, law enforcement told Texas Health an unauthorized individual may have accessed the email accounts in October 2017 as part of a larger incident affecting multiple entities across the U.S. Officials asked Texas Health to refrain from contacting the affected patients so they could complete the investigation without interruption. The organization tapped a forensic firm and began its own internal investigation.
Texas Health determined the email accounts may have included patients' names, medical record numbers, dates of birth, addresses, insurance information, clinical information and in some instances Social Security numbers, driver's license numbers and state identification numbers.
Law enforcement gave Texas Health the OK to notify its patients to the potential breach, and officials mailed notification letters April 13.
The organization does not have evidence the information was misused.
"For those patients whose Social Security numbers were included, we are offering one year of free credit monitoring. We recommend affected patients review any statements they receive from their health insurer," a notification on the organization's website reads. Texas Health has also established a dedication call center to address patients' concerns.
More articles on cybersecurity:
Inogen reports breach of 30k customers' personal information
Atlanta's ransomware attack cost $2.7M
Hackers claim they can breach a hospital in less than 5 hours: 10 report insights