Nebraska Medicine nebraskamed.com Nebraska Medicine data breach: what happened and what to do
Nebraska Medicine reported that an employee improperly accessed the electronic medical records of 1,149 people. The access came to light in an audit on October 1, 2019. Exposed details included names, addresses, dates of birth, Social Security numbers, driver's license numbers, lab results and treatment information.
View all 13,177 breaches- Breach date
- Oct 2019
- Affected
- 1,149
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Driver's licenses, Lab results, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
This was an insider incident, not an outside hack. Nebraska Medicine reported to the U.S. Department of Health and Human Services that an employee impermissibly accessed the electronic medical records of 1,149 individuals.
Local news reports say the health system found the access during an audit of its electronic records system on October 1, 2019, and that it dismissed the employee the following day. Nebraska Medicine told the Nebraska Attorney General on November 27, 2019 and began notifying patients in early December.
Sources checked: ocrportal.hhs.gov, wowt.com, infosecurity-magazine.com
Last verified against the official page:
What was exposed
HHS's breach description lists names, addresses, dates of birth, Social Security numbers, driver's license numbers, lab results and other treatment information. Not every person had every item exposed.
Medical details are hard to change once someone has seen them. The practical risks are medical identity theft, fake claims billed to your insurance, and calls or letters from people who know your condition and pretend to be a provider or insurer.
The response
HHS says Nebraska Medicine sanctioned the employee and added administrative and technical safeguards. Local reports say it offered a year of free credit monitoring to patients whose Social Security number or driver's license number was involved.
The access was by one employee, and nothing reported says the records were published or sold.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops anyone opening new credit in your name. Place one at Equifax, Experian and TransUnion; the FTC explains how.
- 2
Read your insurance statements
Check explanation-of-benefits statements for care you didn't receive. If you spot a claim you don't recognize, call your insurer and report it. The FTC lists medical identity theft steps.
- 3
Use the free credit monitoring if you still can
Nebraska Medicine offered one year of free credit monitoring. The FTC recommends taking such offers. If you kept your letter, check whether the enrollment deadline has passed, and if it has, a credit freeze still protects you.
- 4
Expect phishing that mentions the breach
Messages that mention your hospital, doctor or insurer may be fake. Don't click links or call numbers in unexpected messages. Go to the company's own website instead, and report scams at ReportFraud.ftc.gov.
- 5
Report misuse and watch your reports
Check your credit reports at annualcreditreport.com. If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
Official filings
- U.S. Department of Health and Human Services , filed 27 Nov 2019 : 1,149 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Nebraska Medicine breach?
Nebraska Medicine mailed notices to the patients involved. If you received one, your records were among the 1,149 reported to HHS.
Was this a hack?
No. HHS describes it as an employee impermissibly accessing records. No source says the data was published or sold.
What was exposed?
Names, addresses, dates of birth, Social Security numbers, driver's license numbers, lab results and other treatment information, depending on the person.
Should I freeze my credit?
If the notice says your Social Security number or driver's license number was involved, yes. A freeze is free.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- wowt.com/content/news/Nebraska-Medicine-discloses-data-breach-by-former-employee-565745881.html
- infosecurity-magazine.com/news/data-breach-at-nebraska-medicine/
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov
- consumer.ftc.gov/articles/medical-identity-theft
Something wrong or out of date? Tell us and we'll re-check it.
