May 28 (UPI) — A University of Chicago Medicine Medical group cybersecurity breach in July may have exposed personal information of 38,000 patients.
The exposed data includes names, Social Security numbers, addresses, dates of birth, medical information and financial account information.
Third-party debt collection vendor Nationwide Recovery Systems notified UChicago Medicine on April 8 that the data breach occurred in July 2024.
A UChicago Medicine statement said, “From July 5, 2024, to July 11, 2024, an unauthorized individual gained access to NRS systems and obtained information from certain files and folders. Upon learning of this, NRS took steps to terminate the unauthorized access and make enhancements to further secure their systems.”
The statement added that NRS recently finished an analysis and review that determined personal information may have been involved.
But the statement also said NRS is “not aware of any misuse of the personal information potentially affected by this incident.”
NRS was terminated as a third-party vendor.
“We have terminated our relationship with Nationwide Recovery Services, Inc.,” UChicago Medicine’s statement said. “NRS has confirmed they implemented additional security measures to prevent the occurrence of a similar event in the future.”
The data breach at NRS also affected the City of Chattanooga, Swedish Edmonds Hospital, MAK Anesthesia and Duncan Regional Hospital.
According to The Hippa Journal, NRS previously confirmed that the data breach had affected Harbin Clinic, Northeast Georgia Health System, Rhea Medical Center, Erlanger Western Carolina Hospital and Vitruvian Health.
The Vitruvian Health breach also affected Hamilton Health Care System, as well as affiliates Hamilton Emergency Medical Services, Hamilton Physician Group, Hamilton Medical Center and Anna Shaw Children’s Institute.
UChicago Medicine is notifying patients with addresses on file by mail and also has posted an online notice for other affected patients.
