Washington University School of Medicine notifies patients of privacy incident
Washington University School of Medicine (the “School of Medicine”) today began mailing letters to patients whose information may have been involved in a recent security incident.
The School of Medicine recently identified suspicious activity within its computer network. The School of Medicine immediately initiated its incident response protocols, which included isolating potentially impacted devices and shutting off select systems. It also began an investigation with the assistance of a computer forensic firm. The investigation determined that an unauthorized person gained access to the School of Medicine’s network between April 27 and April 29, 2022 and, during that time, accessed some of the documents on its system.
On May 23, 2022, the School of Medicine learned that some of those documents contained patient information. The School of Medicine initiated a review of the documents involved to determine what information may have been accessible to the unauthorized person. This review is currently ongoing. However, at this time, the School of Medicine has identified documents containing patient names, dates of birth, medical record or patient account numbers, and/or clinical information, such as dates of service, locations of service, provider names, or diagnoses. In some instances, health insurance information and/or Social Security numbers have also been identified in the documents.
This incident did not affect all School of Medicine patients, but only those whose information was included in the affected documents.
On July 14, 2022, the School of Medicine began mailing notification letters to individuals whose information was identified in the documents reviewed thus far. Upon completion of its ongoing review, the School of Medicine will mail notification letters to additional individuals whose information is found in the documents and for whom the School of Medicine has sufficient contact information to mail a letter. The School of Medicine has also established a dedicated, toll-free call center to answer questions that individuals may have about the incident, available at event is (855) 516-3862, Monday through Friday, from 8:00 a.m. to 5:30 p.m. Central Time. For those whose Social Security numbers or driver’s license numbers are included in the affected documents, the School of Medicine is offering complimentary credit monitoring and identity protection services. The School of Medicine also recommends that affected individuals review statements they receive from their health insurers or healthcare providers. If they see charges for services they did not receive, they should contact the insurer or provider immediately.
To help prevent something like this from happening in the future, the School of Medicine has enhanced its existing network monitoring capabilities and will continue to regularly audit its systems for any unauthorized activity.
Additional information is available here on the School of Medicine’s website.
