Nashville, Tenn.-based Vanderbilt Health is notifying 3,298 patients that their medical information may have been exposed after an employee clicked a malicious link in a phishing email, according to a filing with the HHS Office for Civil Rights.
Vanderbilt discovered March 27, 2026, that an unauthorized individual had gained access to an employee’s email account through the malicious link, according to a notice from the health system. An investigation found the individual accessed certain documents in the account on March 23 and may have viewed attachments containing patient names, medical record numbers, admission, discharge or visit dates, diagnosis or procedure information, and provider or facility names.
Vanderbilt said no Social Security numbers or financial information were involved, and the incident did not affect its electronic medical record system.
Vanderbilt is notifying affected patients by mail and offering complimentary credit monitoring. The health system said it is also enhancing its email and digital security measures and expanding cybersecurity training for employees to prevent similar incidents.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
