Notice to our Patients Regarding Phishing Incident
On February 11, 2014 Centura Health experienced a phishing" attack where outside attackers attempted to acquire employee usernames and passwords by posing as a trustworthy source by e-mail. A small group of Centura Health employees responded to the e-mails thinking they were legitimate requests. When we learned of this, we were able to immediately stop the attack and began an investigation. On February 21, 2014 we became aware that a small number of employee e-mail accounts may have been accessible as a result of the phishing. We hired an outside forensics expert firm to perform a comprehensive review of the affected employees e-mail accounts and confirmed that some of the e-mails contained patient information and may have included patient demographic information (e.g., name, address, date of birth, telephone number) and/or clinical information (e.g., medical record number, date of service, treating physician, diagnosis), and in some instances Medicare Beneficiary number and Social Security number.
There is no evidence that the information in the emails was ever viewed or used in any way. However, as a precaution, Centura Health began mailing letters to potentially affected patients on April 22, 2014. This incident did not affect all Centura Health patients. We have established a dedicated call center to assist patients with any questions and it will go live on April 22 at 6:00 p.m. Mountain Time. If you believe you have been affected, but have not received a letter by May 12, 2014, please call 1-800-964-1042 Monday through Friday between 7:00 a.m. and 7:00 p.m. Mountain Time.
Centura Health took immediate steps to implement and/or reinforce necessary protective measures to help prevent similar events in the future. Those steps included immediately stopping the attack, performing an investigation and hiring an outside forensics expert to assist, reinforcing education to all employees regarding phishing" e-mails, and continuing to implement enhancements for strengthening user login authentication. Centura Health has also notified the appropriate authorities.
We deeply regret any inconvenience this may cause our patients.