Aurora Health Care advocateaurorahealth.org Aurora Health Care data breach: what happened and what to do
A vendor of Aurora Health Care received patient information without a business associate agreement in place. HHS says about 869 people were affected: names, dates of birth, Social Security numbers and registry identification numbers.
View all 13,177 breaches- Breach date
- Apr 2016
- Affected
- 869
- Data exposed
- Names, Dates of birth, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Aurora Health Care, Inc. reported a breach to the U.S. Department of Health and Human Services (HHS) in April 2016. The incident started with a business associate, the American College of Cardiology Foundation, which inadvertently disclosed some Aurora patient information to one of its vendors without first signing a business associate agreement. A business associate agreement is the contract HIPAA requires before a vendor handles patient data.
HHS lists about 869 affected people. HHS gives no breach start date, so the date on this page is when it was reported.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS says the information included names, dates of birth, Social Security numbers and registry identification numbers.
The company's response
Aurora notified HHS, the people affected and the media. HHS says Aurora investigated the root cause, halted a demonstration, destroyed the data, suspended access to the environment and checked that the testing environment held no patient data. It also reviewed vendor controls and access, turned off the copy and paste function in the registry environment and formalized procedures for moving data out of the live environment. HHS says it obtained documented assurances that these steps were taken and reviewed Aurora's policies for protecting patient information.
What it means for you
A name, birth date and Social Security number is the core set used to open credit in someone else's name. The number of people involved is small, but if you received a notice, treat the exposure seriously.
What to do if you were in it
- 1
Place a free credit freeze
A freeze at Equifax, Experian and TransUnion blocks new accounts opened in your name. It's free, and the FTC explains how credit freezes and fraud alerts work.
- 2
Watch your statements and explanations of benefits
Look for charges, accounts or medical bills you don't recognize, and check your credit reports at annualcreditreport.com.
- 3
Report identity theft right away
If someone misuses your details, report it at IdentityTheft.gov to get a recovery plan.
- 4
Expect phishing that mentions the breach
Don't click links in unexpected messages. The FTC explains how to recognize and avoid phishing.
- 5
Check which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you; it can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 1 Apr 2016 : 869 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Aurora Health Care breach?
HHS lists about 869 people. Aurora notified the people affected by letter, so check your mail if you were a patient.
What was exposed?
Names, dates of birth, Social Security numbers and registry identification numbers, according to HHS.
Should I freeze my credit?
If your Social Security number was exposed, the FTC says a credit freeze is a free way to stop new accounts being opened in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
