January 21, 2022
Thom Carroll/for PhillyVoice
Jefferson Health, one of Philadelphia's biggest hospital systems, suffered a data breach in November affecting more than 9,000 patients. A hacker gained access to a remittance sheet containing billing information.
Jefferson Health is notifying more than 9,000 patients whose personal information may have been exposed during a privacy breach late last year.
An unauthorized person accessed an online portal used by Jefferson staffers to submit billing information to Independence Blue Cross on Nov. 18 and attempted to divert wire payments meant for Jefferson, according to the health system.
The hacker gained access by impersonating two authorized staff members in order to reset passwords on the portal, Jefferson spokesperson Deana Gamble said.
Jefferson launched an investigation with Independence and notified law enforcement.
On Nov. 22, the investigation determined the hacker obtained a remittance sheet containing the billing information of 9,095 patients. The data included names, dates of service, treatment codes and costs.
Social security numbers, health insurance information and financial account information were not involved in the breach, the health system said.
Jefferson began mailing letters Thursday to patients whose personal information may have been compromised. All Jefferson patients are asked to review statements from their health insurers to ensure they're not being charged for services they didn't receive.
"Jefferson Health regrets this incident occurred and is committed to protecting the security and privacy of patient information," the hospital said.
When asked why it took nearly two months to begin notifying impacted patients, Gamble said "Jefferson acted in accordance with applicable notification obligations."
She added that Jefferson launched an investigation "quickly" and notified law enforcement soon after the incident was discovered. The health system also has implemented new security protocols to prevent data breaches in the future.
"We enhanced the process related to password resets," Gamble said. "We are working to review and enhance our security protocols, including those surrounding third-party online platforms."
Patients who have questions can call (855) 618-2620. The toll-free number is open Monday through Friday from 9:30 a.m. to 6:30 p.m. with the exception of major holidays.
