Omnicell omnicell.com Omnicell data breach: what happened and what to do
In November 2012, a device holding medication dispensing log files was stolen from an Omnicell employee's locked car. HHS lists 56,820 affected patients of Sentara, with names, birth dates and clinical information exposed.
View all 13,115 breaches- Breach date
- Nov 2012
- Made public
- 31 Dec 2012
- Affected
- 56,820
- Data exposed
- Names, Dates of birth, Patient numbers, Medical record numbers, Clinical information
- Last updated
What happened
Omnicell makes electronic medication dispensing systems used by hospitals. In November 2012, an electronic device holding medication dispensing cabinet log files from three health system customers was stolen from the locked vehicle of an Omnicell employee. Omnicell described this in its own filing with the SEC.
Who was affected
Omnicell is a business associate of the health system Sentara, which means it handles patient data on Sentara's behalf. The US Department of Health and Human Services (HHS) lists 56,820 of Sentara's patients in the breach. HHS says the data was reported to HHS, the media and affected people.
What was exposed
Per HHS, the data included patient names, birth dates, patient numbers, medical record numbers and clinical information. HHS doesn't say that Social Security numbers were involved.
What it lets criminals do
A name and birth date together are useful to identity thieves and for convincing phone scams. Clinical information is sensitive, and can be used to make a scam call or letter sound like it comes from your provider.
The response
HHS's Office for Civil Rights investigated. It obtained an executive summary of Omnicell's risk analysis and Sentara's own risk analysis, and confirmed Sentara had a proper business associate agreement in place. The breach happened before the September 23, 2013 compliance date of HHS's later rules.
The breach is from 2012, so the practical risk now is old data being reused alongside newer leaks.
What to do if you were in it
- 1
Read any notice from your provider
If you were a Sentara patient in 2012 and got a letter, it explains what was involved for you.
- 2
Expect calls and messages that mention your care
Don't give details to anyone who calls you. Hang up and call your provider on the number on your card or its website.
- 3
Watch your health insurance statements
Check explanation of benefits statements for services you didn't receive, and report them to your insurer.
- 4
Freeze your credit if you want extra protection
A free freeze at Equifax, Experian and TransUnion stops new accounts being opened in your name.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the steps here are what protect you.
Frequently asked
Was I affected by the Omnicell data breach?
If you were a Sentara patient whose data was on the stolen device, possibly. HHS lists 56,820 people.
What was exposed?
Names, birth dates, patient numbers, medical record numbers and clinical information, per HHS.
Should I change my password?
No passwords were reported exposed. Focus on watching for scams and checking insurance statements.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
