HealthEC LLC healthec.com HealthEC data breach: what happened and what to do
HealthEC, a health data analytics company, reported a cybersecurity incident that affected 4,786,241 people, per HHS. Between 14 and 23 July 2023 an intruder accessed systems. Exposed data included Social Security numbers, diagnoses and insurance information.
View all 13,115 breaches- Breach date
- 14 Jul 2023
- Made public
- 21 Dec 2023
- Affected
- 4,786,241
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Driver's licenses, Medical information, Health insurance information
- Last updated
What happened
HealthEC LLC provides population health software to hospitals, health systems and insurers. It is a business associate, meaning a company that handles patient data on behalf of providers. In December 2023 it told HHS that a cybersecurity incident had compromised the health information of 4,786,241 people.
Notices said an unauthorised party accessed some of its systems between 14 and 23 July 2023 and copied files that its customers had entrusted to it. Because HealthEC works for others, many people learned of the breach through a provider or plan they had dealt with, not through HealthEC itself. Reported affected customers include Corewell Health, HonorHealth and the Tennessee Medicaid agency TennCare.
Press reports gave smaller counts, around 4.5 million, from earlier filings. The HHS total of 4,786,241 is the figure used here.
What was exposed
HHS's description lists names, addresses, birthdates, Social Security and driver's license numbers, diagnoses, lab results, medications, and claims and other treatment information. Notices also mentioned health insurance information and billing data.
With a full identity record and medical details together, criminals can attempt tax fraud, open credit accounts, or make false insurance claims. Medical details also feed convincing phone scams.
The company's response
HealthEC notified HHS, affected people and the media, posted substitute notice and added more administrative, technical and security safeguards. It offered 12 months of credit monitoring and identity protection, according to reports.
What this means for you
If a provider, hospital or plan wrote to you about HealthEC, follow the steps in the letter. You may never have heard of this company, which is why the letter can look like junk mail. Don't throw it away.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Because identity numbers were involved, place a free credit freeze at Equifax, Experian and TransUnion. A freeze stops anyone opening new credit in your name. Lift it temporarily when you apply for credit yourself.
- 2
Use the free identity protection
If your notice includes a monitoring code, activate it. It supplements a freeze by alerting you to new activity.
- 3
Read your explanation of benefits
Look for claims, prescriptions or visits you don't recognise. Report them to your insurer.
- 4
Get an IRS Identity Protection PIN
Social Security numbers were exposed, so ask the IRS for a PIN that stops anyone filing a tax return in your name.
- 5
Be careful with unexpected medical calls
If someone calls about a bill, lab result or prescription, hang up and call the provider on a number you already trust.
Frequently asked
Who is HealthEC and why did I get a letter?
HealthEC is a business associate that provides data services to health organizations. You'd have been notified if your provider or plan was a customer.
What was exposed?
Names, addresses, birthdates, Social Security and driver's license numbers, diagnoses, lab results, medications, claims and insurance information.
How many people were affected?
HHS lists 4,786,241 people. Some earlier press reports gave about 4.5 million.
Should I freeze my credit?
Yes. Social Security numbers were involved. A free freeze at the three bureaus prevents new accounts in your name.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
