Atrium Health Foundation

Atrium Health reported to HHS on 2024-12-02 an Unauthorized Access/Disclosure affecting 585,959 individuals. The breach stemmed from historical use of web tracking technology on its patient portal, which may have exposed PHI including clinical and demographic information. Breached information was located on a Network Server. The CE notified HHS, affected individuals, the media, and posted substitute notice.

Atrium Health notified affected individuals in Montana and other states that an unauthorized third party gained access to employee email accounts via phishing on April 29, 2024. The incident may have exposed personal, health, and financial information. Atrium Health engaged forensic consultants, notified law enforcement, secured accounts, and offered 24 months of Kroll identity monitoring.

Atrium Health reported to HHS on 2024-09-13 a Hacking/IT Incident affecting 32120 individuals. Breached information located on Email.

ATRIUM HEALTH filed a data-breach notice with the Illinois Attorney General in September 2024 (case 24-09-046). The register records the breach as discovered on April 29, 2024. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Atrium Health at Home reported to HHS on 2022-06-07 a Hacking/IT Incident affecting 6,695 individuals. Breached information located on Email. An employee was the subject of an email phishing scheme that exposed PHI including names, DOB, addresses, SSNs, medications, and diagnoses. Response included credit monitoring, security safeguards, and staff retraining.

Atrium Health notified Montana residents of a third-party vendor breach involving Blackbaud. A ransomware attack on Blackbaud's systems (Feb-May 2020) led to the exfiltration of patient personal and demographic data. Atrium Health investigated, set up a call center, and is reviewing security safeguards.

Atrium Health (NC) reported to HHS on 2020-09-01 a Hacking/IT Incident (ransomware) affecting 165,000 individuals. The breach occurred at a business associate and involved ePHI stored on a network server. Exposed data included names, addresses, dates of birth, and treatment information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website.

Atrium Health notified NH AG of a breach at third-party vendor AccuDoc Solutions. Unauthorized access occurred Sept 22-29, 2018. Data involved: names, addresses, DOB, SSNs, medical record numbers, insurance info. 586 total individuals affected (64 NH residents). Notifications sent Nov 27, 2018. Forensic investigators engaged; FBI notified; credit monitoring offered.

Atrium Health notified patients of a cyber incident involving third-party billing vendor AccuDoc Solutions. Unauthorized access to AccuDoc's databases occurred between Sept 22-29, 2018. Data potentially exposed included names, addresses, DOB, insurance info, medical record numbers, and SSNs. Atrium engaged forensic investigators and FBI; offered 1-year Kroll identity monitoring.

Atrium Health notified patients of a cyber incident involving third-party billing vendor AccuDoc Solutions, Inc. Unauthorized access to AccuDoc's databases occurred between Sept 22-29, 2018. Patient PII including names, addresses, DOBs, SSNs, and medical record numbers were potentially exposed. No financial account numbers or clinical records were accessed. Atrium engaged forensic investigators and offered one year of free credit monitoring.

Atrium Health reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-11-27. 257 Massachusetts residents were affected. The report records the breach type as electronic.