Notice of Data Privacy Events
About the data privacy event
Alive Hospice recently discovered an event that may affect the security of certain personal information. While, to date, we have no evidence that personal information potentially affected by this event has been misused, we are providing notice of the event so potentially affected individuals may take steps to better protect against possible misuse of information, should they feel it appropriate to do so.
Frequently asked questions
Q. What Happened? On or around May 6, 2019, Alive Hospice became aware of unusual activity related to an employee’s email account. Alive Hospice immediately took steps to respond to and investigate this activity and change the user’s password. Through the investigation, which included working with third party forensic investigators, Alive Hospice determined that an unauthorized individual gained access to a single Alive Hospice employee email account between May 4, 2019 and May 6, 2019.
On July 3, 2019, Alive Hospice undertook a mailing of notification letters to individuals whose information was present in the affected email account. On or about July 9, 2019, Alive learned that an error occurred in the address export process for the mailing which resulted in the notification letters being addressed to the incorrect recipient. Alive Hospice immediately took steps to correct the address error and mailed a corrective letter to all recipients of the July 3, 2019 mailing. This subsequent notice included a statement explaining the issue with the prior mailing.
Q. What Information Was Involved? While the information present in the relevant email account varies by individual, Alive Hospice’s investigation determined that it may include name, date of birth, Social Security number, driver’s license number, financial account number, medical history information, treatment and prescription information, treating or referring physician information, medical record number, health insurance information, Medicare or Medicaid number, username/email and password information. Additionally, the notification letters mailed on July 3, 2019, did not include any reference to treatment through Alive, nor did they make reference to protected health or patient information. The letters included the incorrect recipient’s name and referenced Alive Hospice as the entity making the notification. To date, Alive Hospice has no evidence that any information potentially impacted by this incident was subject to actual or attempted misuse.
Q. What Is Alive Hospice Doing to Respond? Alive Hospice places the highest priority on the confidentiality, privacy, and security of the personal information in our care. With cyberattacks increasing in healthcare and other industries around the world, we are constantly working with our internal team and outside experts to monitor security and implement new measures to strengthen our systems and protect our organization and those who depend on us.
Upon learning of unusual activity in an employee email account, we immediately commenced an investigation to confirm the nature and scope of the event and identify what personal information may have been present in the affected emails. With the assistance of third-party forensic investigators, we have been working to identify and put in place resources to assist potentially affected individuals. While we have stringent security measures in place to protect information in our care, we are implementing additional safeguards to further protect the security of information in our systems.
Alive Hospice has mailed notice letters to individuals who may have been affected by the email incident and next of kin, as appropriate. Alive Hospice is offering potentially impacted individuals access to credit
monitoring and identity restoration services for one year without charge. Additionally, upon learning of the issue with the initial mailing related to the email incident, Alive immediately took steps to mail a corrected letter to recipients of the July 3, 2019 mailing. This subsequent notice included a statement explaining the issue with the prior mailing. Alive Hospice has provided notice to the U.S. Department of Health and Human Services, as well as required state regulators.
Q. What Can I Do to Protect My Information?
Monitor Your Accounts
We encourage you to remain vigilant against incidents of identity theft and fraud, to review your account statements, and to monitor your credit reports for suspicious activity. Under U.S. law you are entitled to one free credit report annually from each of the three major credit reporting bureaus. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your credit report.
You have the right to place a “security freeze” on your credit report, which will prohibit a consumer reporting agency from releasing information in your credit report without your express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a security freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a security freeze on your credit report. Should you wish to place a security freeze, please contact the major consumer reporting agencies listed below:
In order to request a security freeze, you will need to provide the following information:
- Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
- Social Security number;
- Date of birth;
- If you have moved in the past five (5) years, provide the addresses where you have lived over the prior five years;
- Proof of current address, such as a current utility bill or telephone bill;
- A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.);
- If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft.
As an alternative to a security freeze, you have the right to place an initial or extended “fraud alert” on your file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any one of the agencies listed below:
You can further educate yourself regarding identity theft, fraud alerts, security freezes, and the steps you can take to protect yourself by contacting the consumer reporting agencies, the Federal Trade Commission, or your state Attorney General.
The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); or TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. You have the right to file a police report if you ever experience identity theft or fraud. Please note that in order to file a report with law enforcement for identity theft, you will likely need to provide some proof that you have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement and your state Attorney General. This notice has not been delayed by law enforcement.
Q. Where Can I Go to Get More Information? Alive Hospice has set up a dedicated assistance line to answer questions regarding this incident. The dedicated assistance line may be reached at 1-800-939-4170 (toll free), Monday through Friday from 8 am - 7 pm Central Time.