CHI St. Luke’s Health-Memorial reported Monday that an unauthorized third party gained access to patient information on April 23.
“Though we have no evidence to confirm that information was actually viewed or obtained by the unknown outside party, CHI St. Luke’s Health-Memorial Lufkin is providing notice of this event to potentially impacted individuals as well as certain regulators out of an abundance of caution,” a press release states.
The release also states that the hospital is taking action to protect the security and confidentiality of patient’s health information.
“An internal investigation was launched by the CHI St. Luke’s threat management team, and vendors were engaged to conduct a forensic investigation,” the release states. “The investigation included engaging forensic experts, interviewing employees, reviewing data and access logs, conducting threat intelligence analysis and reviewing various data file types in order to determine what if anything had happened.”
The statement indicates the hospital has taken steps to confirm that its network remains secure, but it did not say what those steps are exactly. Additionally, they are working with law enforcement and forensic experts and have reset passwords across the facility, replaced and upgraded hardware, made changes to software and changed processes for accessing the network.
The security breach was made through two employee email accounts including patient information such as names, diagnoses, dates of services and facility account numbers.
“Though we have no evidence to confirm that information was actually viewed or obtained by the individual, we cannot totally rule it out as a possibility,” the release states. “We discovered the potential exposure as we were investigating a security event involving one of our servers, which we learned about on March 25.”
The hospital has established a call center at (844) 961-2413 with its partner Kroll to assist in answering any questions impacted individuals may have. The center is open from 9 a.m. to 6 p.m. Monday through Friday.
“CHI St. Luke’s Health encourages individuals to remain vigilant against incidents of identity theft and fraud, to review their bank and credit statements and to monitor their credit reports for suspicious activity,” the release states. “Under U.S. law individuals are entitled to one free credit report annually from each of the three major credit reporting bureaus.”
The hospital recommends visiting annualcreditreport.com or calling (877) 322-8228 to order a free credit report.
“Individuals may also contact the three major credit bureaus directly to request a free copy of their credit report,” the release states. “Additionally, certain individuals affected by this incident may be eligible for Experian Credit Monitoring at no cost for up to a year. For more information about protecting personal information, impacted individuals may contact the FTC for resources.”
The Lufkin Daily News has contacted the hospital with more questions and will be updating this story as more information becomes available.