UofL Health details privacy incident
Subscriber Benefit
As a subscriber you can listen to articles at work, in the car, or while you work out. Subscribe Now
UofL Health says it is mailing letters to patients whose information may have been involved in a privacy incident that also involves an Indiana state agency.
The health system, affiliated with the University of Louisville School of Medicine, said it was notified in June of the incident involving the MOVEit software used by an external vendor.
The software is used by Virginia-based Maximus Health Services Inc., which has served as the enrollment broker for the Indiana Health Coverage Programs since 2007, according to the Indiana Family and Social Services Administration.
The FSSA said earlier this month that the security breach of the software exposed the personal information of more than 744,000 members of Indiana Medicaid.
UofL Health says a small handful of its medical practices use the software, and a forensic investigation found that the breach allowed an unauthorized party to access certain files of a small percentage of UofL Health patients, including names, dates of service, dates of birth, patient account numbers, member ID numbers, Social Security numbers and addresses.
“No evidence suggests that this data has been further compromised and UofL Health has found no evidence that patient information has been misused,” the health system said in a news release.
A spokesperson for MOVEit says the company disclosed the vulnerability on May 31, and deployed a patch the same day.
UofL Health said its own network and electronic medical records databases were not compromised.
“In the wake of this incident, UofL Health has continued to implement additional technological and administrative measures to safeguard personal information, including a review of protocols related to third-party vendors,” the health system said.
In addition to mailing letters to patients, UofL Health has established a call center to answer any questions from patients. The center is open Monday through Friday from 9 a.m. to 9 p.m. at 833-627-2802.
The health system’s footprint includes more than 1,000 providers in Louisville and surrounding counties, including southern Indiana.