Texas hospital shared the healthcare data of over 40,000 patients with a third party vendor

Dallas, Texas-based healthcare provider UT Southwestern Medical Center said that a major cyber attack, which struck its systems in October, compromised the sensitive personal information of more than 40,000 individuals.

In a security incident notification posted on its website, UT Southwestern Medical Center (UTSW) said that on October 10, it became aware of a data leak after its employees accidentally gave its vendor access to a third-party calendar management tool that the employees used.

The calendar management tool contained patients’ protected health information along with their personal identifiable information. The compromised data included names, dates of birth, medical record numbers, phone numbers, dates of service of planned services, medical diagnoses, lab results, medication information, insurance benefits information, and, in some instances, partial social security numbers.

UTSW has, however, confirmed that the calendar management tool did not contain any credit card numbers or patients’ financial account information.

UTSW alerted the U.S. Department of Health and Human Services about the data exposure, stating that it has identified at least 43,048 individuals whose data was exposed to the third party vendor.

“Protecting our patients’ privacy is of utmost importance at UT Southwestern, and we regret any inconvenience or concern this incident may cause. UTSW has implemented robust processes to limit the amount of information shared with third-party vendors and will continue monitoring for sensitive data leaving its network and systems,” it said.

UTSW has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.