Trinity Health of New England breach impacts more than 45,000 patients

Trinity Health of New England (THONE) has suffered a cyber attack that compromised the sensitive personal information of its patients.

Based in Livonia, Michigan, Trinity Health Corporation is a medical services company providing information technology and billing services for its member hospitals and healthcare providers, including Trinity Health Of New England.

In a filing with the Massachusetts Attorney General, the healthcare provider said that on January 5, it identified unusual activity in an employee’s email account and immediately launched an investigation to understand the scope of the security incident.

“The investigation determined there was unauthorised access to the account for a limited period of time between December 16, 2022 and December 18, 2022,” THONE said in a notice on its website.

The internal review, which concluded on February 14, confirmed that the sensitive personal information of its patients was compromised in the security incident. The compromised information included names, medical record numbers/patient ID numbers, encounter numbers, location of service, provider names and specialty, procedure names, insurance name/type, billing Balance, and dates of birth. For a very limited number of patients, the information may also have included addresses, phone numbers, email addresses, and prescription information.

Trinity Health also said that it did not find any evidence of the compromised information being misused, however, the possibility of the same cannot be ruled out. It has urged all affected individuals to remain vigilant and report any suspicious activity to relevant law enforcement authorities. Furthermore, as a precaution, it has changed the email account password and reviewed policies and procedures related to data protection.

While Trinity Health did not disclose the number of affected individuals, a filing with the U.S. Department of Health and Human Services Office for Civil Rights confirms that 45,350 individuals were affected in the security incident. From March 9, the healthcare provider has started notifying all affected individuals whose data was compromised in the recent data security incident.