Indian Health Council, Inc. (“Indian Health”) recently experienced a data security incident that may have impacted the protected health information (“PHI”) of some of its patients. Indian Health takes the security of its patient’s information seriously and has notified those patients of the incident.
What happened? On September 22, 2020, Indian Health discovered that some of its files were encrypted and system access was disrupted. Indian Health hired independent computer forensic experts who determined that an unauthorized individual gained access to certain files stored on Indian Health’s system that contained patient PHI.
What information was involved? Impacted information includes patient names, dates of birth, health information, and health insurance information. For a limited number of individuals, medical information, condition, treatment, or diagnosis information may have also been disclosed.
What is Indian Health doing? Indian Health is sending a letter to impacted individuals and providing notice to appropriate regulatory agencies. Indian Health has also taken steps to minimize the risk of this kind of event from happening in the future. Since the incident, Indian health applied additional controls for any type of remote access to their systems, changed all impacted passwords, and implemented multi-factor authentication.
“Our patients’ trust is essential to Indian Health, and we regret any concern or inconvenience this has caused,” said Orvin Hanson, Chief Executive Officer of Indian Health. “The privacy and protection of our patient’s information is a matter we take seriously, and we have taken steps to help prevent this type of incident from occurring in the future.”
For more information: To determine whether you were affected or for more information about this incident, please call 1-833-905-3232. Individuals can also contact the Federal Trade Commission at 600 Pennsylvania Avenue NW, Washington, D.C. 20580, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866- 653-4261 or visit www.ftc.gov/idtheft/ for more information on protecting their identity.