UMass Memorial Community Healthlink in Worcester on Monday reported a data breach of two employee email accounts from April.
The breach occurred on April 18, and the mental health organization took immediate action to secure the accounts and investigate with the help of a forensic IT firm. It was unable to determine if any sensitive material was viewed.
As a result, the organization reviewed all emails and notified every patient whose information may have been accessed. That information included names, dates of birth, client identification numbers, diagnosis and treatment information, health insurance information, and some Social Security numbers.
Letters have been mailed to patients whose information was in the emails, Community Healthlink said.
The organization did not detail how many patients were affected.
Complimentary credit monitoring will be offered to patients whose Social Security numbers were in the emails, the organization said.
“To help prevent something like this from happening in the future, we forced a password change for the impacted employees’ accounts, strengthened rules to block additional outside domains and impersonation attempts, increased automated alerts, and have implemented additional measures to further strengthen our security processes,” Community Healthlink said. “We are also reinforcing employee training on how to detect and avoid phishing emails.”
Community Healthlink, part of the UMass Memorial Health Care system, provides mental health, behavioral health and substance abuse services.
