Nuvance Health nuvancehealth.org Nuvance Health data breach: what happened and what to do
A business associate of Nuvance Health was hit by ransomware, and HHS lists 314,829 patients as affected (September 2020). The data included names, addresses, age, gender, birth dates, health insurance information and treatment information.
View all 13,177 breaches- Breach date
- 15 Sept 2020
- Affected
- 314,829
- Data exposed
- Names, Physical addresses, Ages, Genders, Dates of birth, Health insurance information, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Nuvance Health, a hospital network in New York and Connecticut, told the US Department of Health and Human Services (HHS) in September 2020 that a business associate had been hit by a ransomware attack. HHS lists 314,829 patients as affected.
What was exposed
HHS's description says the electronic health information included names, addresses, age, gender, dates of birth, health insurance information and other treatment information. Nuvance notified HHS, the patients and the media, and provided substitute notice.
That list doesn't include Social Security numbers or card numbers, which lowers the risk of direct financial fraud. It still leaves you exposed to two things. The first is medical identity theft: a name, birth date and insurance details are enough for someone to try to get care billed to your plan. The second is targeted phishing, where a message names your provider and sounds like a billing notice or a "verify your insurance" request.
The vendor angle
The attack hit a vendor, not Nuvance's own network. HHS doesn't name the vendor or give a date for the attack, so this page can't either. If you were a Nuvance patient around 2020, a notice letter should have reached you. If it didn't, ask Nuvance whether your record was included.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Read your health insurance statements
Check explanation of benefits statements and medical bills for care you didn't get. If you see something wrong, call your insurer and the provider's billing office, and report it to the FTC at IdentityTheft.gov.
- 2
Expect messages that mention the breach
Criminals use your name, address and insurer to make scam emails, texts and calls sound real. Don't click links or call numbers in them. Go to the company's own site, or call the number on your card or statement.
- 3
Ask your insurer to flag your account
Call the number on your insurance card, say your plan details were in a breach, and ask what they can do to watch for misuse. Keep a note of the date and who you spoke to.
- 4
Report misuse
If someone opens accounts or files claims in your name, report it at IdentityTheft.gov, the FTC's reporting site, which gives you a recovery plan.
- 5
Check where else your details are exposed
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus can't remove breach data, but it alerts you when your details turn up so you know when to repeat these steps.
Official filings
- U.S. Department of Health and Human Services , filed 15 Sept 2020 : 314,829 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Nuvance Health breach?
HHS lists 314,829 patients. Nuvance said it notified those affected, so check for a letter and ask the health system if you were a patient and heard nothing.
What was exposed?
Names, addresses, age, gender, dates of birth, health insurance information and other treatment information, according to HHS.
Were Social Security numbers taken?
HHS's description doesn't list them.
Do I need a credit freeze?
The listed data doesn't include a Social Security number. A free freeze is still the FTC's general step if you want extra protection.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
