TriHealth trihealth.com TriHealth data breach: what happened and what to do
A technical error during a data conversion at TriHealth sent letters to the wrong addresses. HHS says 1,126 patients were affected; the details varied but could include names, former addresses, birthdates, diagnoses, lab results and medications.
View all 13,177 breaches- Breach date
- 19 Jan 2017
- Affected
- 1,126
- Data exposed
- Names, Physical addresses, Dates of birth, Medical information, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
TriHealth, Inc. told the U.S. Department of Health and Human Services (HHS) about a mailing error in January 2017. During a data conversion, a technical error caused correspondence to be sent to 1,126 patients' incorrect addresses. HHS lists 1,126 affected people. It gives no start date, so the date on this page is when the breach was reported.
This was not a hack. Letters meant for patients reached other people.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS says the information varied by letter. It may have included full names, former addresses, birthdates, claims information, diagnoses and conditions, lab results, medications and other treatment information.
The company's response
TriHealth notified HHS, the people affected and the media. HHS says it retrained staff, corrected the addresses and developed a plan for added safeguards during data conversions. HHS obtained documented assurances that these corrective actions were put in place.
What it means for you
No Social Security numbers are listed, so the risk of new-account fraud is lower than in many breaches. The exposed information is health detail in the hands of whoever opened the wrong letter, which is a privacy harm rather than a theft campaign. If you were affected, watch your explanations of benefits for services you didn't use, and be wary of anyone who contacts you about your treatment.
What to do if you were in it
- 1
Place a free credit freeze
A freeze at Equifax, Experian and TransUnion blocks new accounts opened in your name. It's free, and the FTC explains how credit freezes and fraud alerts work.
- 2
Watch your statements and explanations of benefits
Look for charges, accounts or medical bills you don't recognize, and check your credit reports at annualcreditreport.com.
- 3
Report identity theft right away
If someone misuses your details, report it at IdentityTheft.gov to get a recovery plan.
- 4
Expect phishing that mentions the breach
Don't click links in unexpected messages. The FTC explains how to recognize and avoid phishing.
- 5
Check which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you; it can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 19 Jan 2017 : 1,126 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the TriHealth breach?
HHS lists 1,126 patients. TriHealth sent notices to those affected, so check your mail if you were a patient then.
What was exposed?
Names, former addresses, birthdates, claims information, diagnoses, lab results, medications and other treatment information, depending on the letter, according to HHS.
Was this a hack?
No. HHS describes a technical error during a data conversion that mailed patient letters to incorrect addresses.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
