Advocate Health Care advocatehealth.com Advocate Health Care data breach: what happened and what to do
On November 24, 2009, a nurse's laptop was stolen from Advocate Health Care. It held protected health information on about 812 people: names, addresses, dates of birth, Social Security numbers, insurance information, medication and diagnoses, per HHS.
View all 13,177 breaches- Breach date
- 24 Nov 2009
- Made public
- 22 Jan 2010
- Affected
- 812
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Health insurance information, Medical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
On November 24, 2009, a laptop belonging to an Advocate Health Care nurse was stolen. The U.S. Department of Health and Human Services (HHS) says the missing computer held the protected health information of approximately 812 people. HHS added the case to its breach list in January 2010.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
The information included names, addresses, dates of birth, Social Security numbers, insurance information, medication and diagnoses. It's an unusually complete set for a small breach. Someone holding it knows who you are, where you live and what you're treated for.
That is enough to try opening credit, to bill medical services to your insurance, or to write a convincing letter pretending to be your clinic. A stolen laptop is not the same as a hacked database, but the data inside can be used the same way.
The company's response
After the theft, Advocate focused on mobile device security and acceptable use. HHS's Office for Civil Rights investigated, and as a result Advocate now requires workforce members who use mobile devices to fill out and submit an acknowledgment form. The form sets out the administrative, technical and physical safeguards they have to follow.
What this means for you
This breach is old, but Social Security numbers and dates of birth don't expire. If you were notified in 2009 or 2010 and never froze your credit, doing it now still helps.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A freeze is free and stops most new accounts being opened in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Lift it when you apply for credit yourself.
- 2
Read your statements and explanation of benefits
Look for charges, accounts or medical services you don't recognize, and report anything odd to the company that sent it.
- 3
Expect messages that mention the breach
Scammers write to affected people with real details to sound credible. Don't click links in unexpected emails or texts. Go to the company's own site or the phone number on your card.
- 4
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email, phone and other details and alerts you when they appear in a new leak.
Official filings
- U.S. Department of Health and Human Services , filed 22 Jan 2010 : 812 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Advocate Health Care breach?
Advocate notified the roughly 812 people involved. If you got a letter about a stolen nurse's laptop around late 2009, you were included.
What was exposed?
Names, addresses, dates of birth, Social Security numbers, insurance information, medication and diagnoses, per HHS.
Is it too late to freeze my credit?
No. A freeze works whenever you place it, it is free, and the data in this breach stays useful to criminals.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
