Legacy Health in Portland, Ore., is notifying about 38,000 patients of a May phishing attack that may have compromised personal, medical and billing information.
Some employees' email accounts may have been accessed by an unauthorized third party as a result of the attack, hospital officials learned June 21.
Legacy immediately launched an investigation into the incident, which found some patient information may have been contained in the email accounts, including patients' names, dates of birth, health insurance information, billing information and medical information regarding care received at Legacy Health. In a limited number of cases, Social Security numbers and driver's license numbers were also included.
The hospital has found no evidence that any of the information has been misused, but as a precaution, it is offering affected individuals credit monitoring services. It also recommends patients review any healthcare statements for services they may not have authorized.