Data from an estimated 45,000 patients may have been compromised after an employee from one of Rush’s third-party financial services vendors improperly disclosed a file containing certain patient information to an unauthorized party.
Patient information that may be affected includes names, addresses, dates of birth and insurance information. Rush said medical and financial data were not included in the breach. The medical center believes none of the compromised information was misused, according to the letter it sent patients.
After discovering the breach Jan. 22, Rush launched an internal investigation and suspended its contract with the vendor. Additionally, the health system is providing a free, yearlong membership to an identity protection service to patients who were affected.
Rush recommends patients affected by the security incident monitor their credit reports and financial accounts for suspicious activity, check their explanations of benefits documents from their health plans and review their rights to fraud alerts and credit freezes.
More articles on cybersecurity:
13 healthcare privacy incidents in February
Montana hospital reports medical records room break-in
IBM: Cybercriminals abandon ransomware for ‘cryptojacking’
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.