Tewksbury Hospital Data Breach: Patients For Last 14 Years Could Be Compromised

TEWKSBURY, MA — A number of patients of Tewksbury Hospital over the last 14 years may have had their health information compromised by a data breach, the Massachusetts Department of Health announced. People who were treated at the hospital from 2003 though May 2017 may have been affected.

A former employee allegedly "inappropriately accessed the records of a number of current and former Tewksbury Hospital patients," the DPH said. The information includes names, addresses, phone numbers, dates of birth, gender, diagnoses, or other information about medical treatment at the hospital. It may have also included the Social Security number for some patients.

The hospital has no indication the information has been misused, the DPH said. The hospital has provided written notice to affected patients for whom the hospital has been able to reach.

Subscribe to Tewksbury Patch and like us on Facebook for more local news and alerts.

WBZ is reporting a former clerk is responsible and that 1,100 patients were affected.

The issue was discovered when a former patient expressed conner in April that someone may have accessed their electronic medical record inappropriately. A review revealed that an unnamed hospital employee appeared to access the records "without a good reason to do," the DPH said. A broader review led to the realization that a number of former and current patients' information was allegedly reviewed by this employee.

The employee is no longer with Tewksbury Hospital or access to the hospital's electronic medical records system. The case has ben reported to to the Massachusetts Attorney General’s Office, the Massachusetts Office for Consumer Affairs and Business Regulation, and the U.S. Department of Health and Human Services Office for Civil Rights.

Tewksbury Hospital said it is reviewing its policies regarding access of the records system and will provide training to members regarding privacy and security of confidential information.

If you are concerned you may have been affected, you could contact one or more of the three major consumer reporting agencies and:

• Notify them of the loss of personal information and request an initial fraud alert to be placed on your credit for 90 days.
• Order a credit report and review it for any signs of fraud on any accounts. For example, look for inquiries listed on the credit report from businesses that accessed your credit without a request.
• Request a security freeze which will restrict the opening of new accounts using your information. Please note that requesting a security freeze on credit may delay, interfere with or prevent timely approval of any requests made for new loans, credits, employment, housing or other services.

You can learn more about your rights under Massachusetts law and contact information for consumer reporting agencies here.

Call the Medical Units and Mental Health Units between 9 a.m.-5 p.m. Monday-Friday if you have questions.

Photo by John Phelan via Wikimedia Commons