Howard University howard.edu Howard University data breach 2015: what happened and what to do
On May 6, 2015, billing contractors sent 1,445 misdirected collection letters for the Howard University Faculty Practice Plan. The letters showed names, account numbers and dates of service. HHS lists it as unauthorized disclosure.
View all 13,177 breaches- Breach date
- 6 May 2015
- Affected
- 1,445
- Data exposed
- Names, Account numbers, Dates of service
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
This was a mailing mistake, not a hack. On May 6, 2015, business associates working for the Howard University Faculty Practice Plan, the university's physician group, sent out 1,445 misdirected collection letters. HHS lists the case as unauthorized access or disclosure.
What was exposed
According to HHS, the protected health information in the letters included names, account numbers and dates of service. It doesn't mention Social Security numbers, financial account numbers or diagnoses. Even so, a letter that says you owed a medical bill on a given date reveals that you saw a doctor, and it landed in someone else's mailbox.
Who was involved
Two billing companies, California Healthcare Medical Billing, Inc. and JP Recovery Services, Inc., handled the collections for the practice plan. The practice plan notified HHS, the people affected and the media, and posted a notice on its website.
What changed
HHS reports that the first company developed new quality assurance policies for reports that contain health information. The second had its IT staff work with the practice plan to check that placement data files are correct before they go into the collection system. HHS's Office for Civil Rights obtained assurances that the corrective actions were in place.
What this means for you
The risk is lower than in a hack, because the data doesn't include identity numbers. Check your own mail and billing statements, and keep an eye out for contact that uses details from the letter.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Check your statements and explanation of benefits
Read your insurance statements and medical bills for services you didn't receive. The FTC's IdentityTheft.gov/databreach page explains what to do for each type of exposed data.
- 2
Review your credit reports
You can order free credit reports and look for accounts you don't recognize. The data in these letters doesn't include a Social Security number, so a credit freeze is optional, but the FTC says it's free if you want one.
- 3
Be careful with calls and letters about the debt
If someone contacts you about a medical bill you don't recognize, don't pay or share details. Contact the provider using a number from its own website and ask for written proof of the debt.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when something new turns up. It can't remove data that has already leaked, so the steps above are still the fix.
Official filings
- U.S. Department of Health and Human Services , filed 10 Jul 2015 : 1,445 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Howard University breach?
HHS lists 1,445 people whose collection letters went to the wrong place. If you were notified, you were one of them.
What was exposed?
Names, account numbers and dates of service, according to HHS.
Was my Social Security number exposed?
HHS's description doesn't list Social Security numbers among the data types.
Was it a hack?
No. HHS describes misdirected collection letters sent by the practice plan's billing contractors.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
