AURORA, Colo. — Children’s Hospital Colorado said Friday a data hack might affect 3,400 patient families.
In the statement, the hospital said the breach took place July 11 after a staffer’s email account was possibly illegally accessed.
The hospital said names, addresses, dates of birth and telephone numbers were potentially affected, but no Social Security numbers or financial information were gathered.
“Limited clinical information, such as diagnosis and treatment received” might have been accessed, the hospital said.
The statement said neither patient charts nor Children’s Hospital Colorado’s electronic medical records system were compromised.
Affected families were being contacted beginning Friday. There is no indication the information has been misused.
At Children’s Colorado, protecting the security and confidentiality of patient personal and medical information is of the utmost importance. Regrettably, this notice concerns an unintentional exposure of protected health information that may affect nearly 3,400 patient families.
On July 11, 2017, Children’s Colorado learned that a team member’s email account may have been accessed by an unauthorized party.
When Children’s Colorado learned of this, it immediately secured the affected email account and began an investigation. This included hiring an outside expert forensics firm. Through a comprehensive review of the affected email account, Children’s Colorado determined that some of the emails included patient demographic information such as names, addresses, dates of birth, and telephone numbers, and also may have included limited clinical information, such as diagnosis and treatment received.
Importantly, neither patient charts nor Children’s Colorado’s electronic medical records system was compromised. In addition, no Social Security numbers or financial information was included in any of the emails. Only the discrete information contained in the single email account was potentially affected.
Children’s Colorado has no evidence that information in the emails has been misused or even accessed. However, in an abundance of caution and full transparency, all potentially affected families will be notified by mail.
Children’s Colorado began sending letters to affected patient families on Sept. 8, 2017, and established a dedicated call center to answer questions patient families may have. Starting Monday, Sept. 11, anyone who has questions regarding this incident can call 1-888-398-6989, Monday through Friday, between 9 a.m. and 9 p.m. Mountain Time.
Children’s Colorado recommends that affected patient families regularly review the explanation of benefits statement they receive from their health insurer. If families identify services listed on their explanation of benefits that they did not receive, they should immediately contact their insurer.
Children’s Colorado deeply regrets any inconvenience caused by this incident. The hospital has implemented enhancements to its existing safeguards and initiated a review of our systems to further improve protection of patient information.