UChicago Medicine Confirms Cybersecurity Breach Affecting 38,000 Patients
UCMC Notice of Med-Data Incident
A data privacy incident reported by Med-Data, Incorporated, affected the University of Chicago Medical Center (UCMC). Med-Data provides revenue cycle services, including solutions for Medicaid eligibility and patient billing. On December 10, 2020, an external party informed Med-Data that some data had been made publicly available. Following this, Med-Data initiated an investigation, which confirmed the breach, leading to the removal of the compromised files. They engaged cybersecurity specialists for further analysis and notified UCMC on February 8, 2021. Impacted individuals received letters, and regulatory agencies were informed on March 31, 2021. More details are available at meddata.com/data-privacy.
The investigation revealed that the compromised data may have included personal identifiers such as names, physical addresses, dates of birth, Social Security numbers, provider names, health insurance names, and subscriber IDs. In response, Med-Data is providing credit monitoring and identity protection services through IDX at no cost and has implemented enhanced security measures, including blocking file-sharing websites and establishing a security operations center.
UCMC is reinforcing efforts to notify patients about the incident and reviewing Med-Data's security practices to ensure alignment with their standards. UCMC remains committed to protecting patient information and holds its vendors to the same standards.
For inquiries regarding this incident, individuals can contact UCMC at 1-833-903-3647.
Cybersecurity Breach at UChicago Medicine
A cybersecurity breach involving Nationwide Recovery Services, Inc. may have exposed the personal information of approximately 38,000 patients at UChicago Medicine. The breach occurred between July 5 and July 11, 2024, when unauthorized access to NRS systems allowed the retrieval of sensitive information. UChicago Medicine was informed of the incident by NRS, which specializes in recovery management and collections.
The exposed data includes first and last names, addresses, dates of birth, Social Security numbers, financial account information, and medical-related information. UChicago Medicine is actively notifying affected individuals and has posted a public notice for those without mailing addresses. Notably, NRS has been terminated as a vendor following the breach, but it reported no known misuse of the compromised information. Other impacted clients of NRS include the City of Chattanooga and Duncan Regional Hospital. For further details, visit hipaajournal.com/nationwide-recovery-service-data-breach.
UChicago Medical Group Data Exposure
The University of Chicago Medical Group confirmed a significant data exposure incident affecting approximately 38,000 patients due to a cybersecurity breach involving NRS. The unauthorized access occurred last summer, and the exposed information mirrors that of the previous breach, including sensitive personal and medical data. UChicago is committed to protecting patient confidentiality and is sending notifications to those affected.
For more information on UChicago's response to the breach, visit uchicagomedicine.org/about-us/privacy-practices/notice-of-security-incident-5-23-25.
Loretto Hospital Data Breach
Loretto Hospital in Austin reported a data breach that may have compromised the personal information of over 500 individuals. An investigation revealed that an unknown actor accessed the hospital's network between January 17 and February 1, copying files and resulting in data loss for records entered on February 2 and 3. The hospital stated it worked diligently to restore patient records during the downtime but acknowledged that some data may not have been fully recovered.
For any queries regarding the breach, affected individuals can contact Loretto Hospital at [email protected].
In the wake of these incidents, organizations must prioritize secure user management and authentication processes. Secure SSO and MFA are critical in mitigating risks associated with data breaches. SSOJet’s API-first platform provides robust solutions for identity and access management, ensuring secure directory sync, SAML, OIDC, and magic link authentication. By implementing these measures, enterprises can enhance their cybersecurity posture.
Explore our services at ssojet.com or contact us to learn how we can assist in securing your organization’s data.
*** This is a Security Bloggers Network syndicated blog from SSOJet authored by Rajveer Singh. Read the original post at: https://ssojet.com/blog/uchicago-medicine-confirms-cybersecurity-breach-affecting-38000-patients/
