Notice to our Patients of Possible Unauthorized Access to Patient Information
Outreach Health Services (“Outreach”) takes seriously the confidentiality and security of our patients’ information. Regrettably, we are notifying patients about a recent incident that may have involved some patients’ information in our email system.
On September 10, 2019, Outreach identified suspicious activity in an employee’s email account. Outreach immediately began an internal investigation, and a leading computer forensic firm was hired to assist. During the investigation, we determined that an unauthorized person gained access to employee email accounts between August 11 and October 13, 2019. The investigation was unable to determine whether the unauthorized person actually viewed any emails or attachments in the accounts. Out of an abundance of caution, Outreach reviewed the emails and attachments in the accounts to identify patients whose information may have been accessible to the unauthorized person. From this review, beginning on November 6, 2019, patient information was identified in the accounts, including patient names, dates of birth, patient account and/or medical record numbers, health insurance information, and clinical information, which may have included dates of service, diagnosis, procedure, and/or treatment information. For a small subset of patients, Social Security numbers, financial account information, and/or payment card information were also found in the accounts.
We have no indication that any patient information has been accessed or misused. However, we are working quickly to notify patients whose information was in the accounts. We have established a dedicated call center to answer questions that patients may have about the incident. The call center can be reached at 1-855-946-0124, Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern Time. We recommend that all Outreach patients carefully review any statements that they receive from their health care providers and health insurer. If a patient identifies any services that he or she did not receive, they should contact the provider or insurer immediately. For eligible patients whose Social Security number was found in the email accounts, Outreach is offering complimentary credit monitoring and identity protection services.
We sincerely regret any concern or inconvenience this incident may cause our patients. To help prevent something like this from happening in the future, we are taking steps to reinforce employee training on privacy and security and are instituting additional security measures.