Years-old breach in metro Boston could affect thousands

Cambridge Health Alliance, a three-hospital delivery system serving Boston’s metro north region, on January 31 learned from local police that some of its patient billing information was found in the possession of an “unauthorized person” and thousands of patients may be at risk for credit card fraud.

The breach apparently had gone undetected for years; it affects only certain patients treated at Cambridge Health Alliance in 2013. Healthcare organizations increasingly are learning of older breaches they were not aware of from police or the FBI as these agencies investigate other breaches and start to link various incidents together.

Up to 2,500 patients may have been affected in the most recent breach, the delivery system told the Boston Globe. The paper also reported that Cambridge Health and police are unsure if the breach was caused by an intentional hack.

Also See: Breach costs rise but few organizations are ready to prevent them

The patients are being notified and an undisclosed number of them with potentially compromised Social Security Numbers are being given one year of credit monitoring and identity protection services from Experian, according to a spokesperson at Cambridge Health.



In addition to Social Security Numbers, other compromised information could include patient names, addresses, phone numbers, dates of birth, treatment charges and discharge dates.

No medical records were affected, according to Cambridge Health Alliance, which serves more than 140,000 patients and also operates the local public health department.

“We deeply regret any inconvenience or concern this incident may cause patients, Cambridge Health Alliance told patients in a notification letter. “We know that our patients’ personal health information is important to them as it is to us. We continue to monitor the security of patients’ health information to help prevent this from happing in the future.”