Data Breach Goes Unnoticed For Nearly 1 Year at KS Hospital

Urgent Team Holdings Breach Affects 166K

Urgent Team Holdings, a group of urgent care and walk-in centers headquartered in Tennessee, suffered a data breach that impacted 166,601 individuals. According to a notice on its website, Urgent Team Holdings discovered that an unauthorized actor had accessed its network between November 12 and November 18, 2021.

By January 31, 2022, Urgent Team Holdings had found that the unauthorized individual potentially removed names, birth dates, and medical record numbers from its network. Despite this discovery, the organization said it still had no evidence that the information was actually viewed or removed.

Urgent Team Holdings encouraged individuals to review their explanation of benefits statements, ask their insurance companies for a report of all services paid, and only share health insurance cards with providers.

“We are committed to maintaining the privacy of personal and protected health information in our possession and have taken many precautions to safeguard it. We continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal and protected health information,” the notice stated.

“Specifically, since this incident, we have implemented multifactor authentication (MFA) as a measure to add additional layers of security to our systems and to lessen the risk of unauthorized access. Additionally, we have implemented a robust antivirus solution to notify us when it detects an attempt to gain unauthorized access to our systems.”

Urgent Team Holdings consists of a network of over 60 urgent care centers across five states in the Southeast.

Arizona Community Mental Health Center Faces Data Breach

The Guidance Center (TGC), which provides mental health services throughout Northern Arizona, began notifying 23,104 individuals of an email data breach. It is unclear when the breach occurred or when TGC first discovered it.

An unauthorized actor accessed TGC employee email accounts containing medical treatment and diagnosis information, patient record numbers, and/or health insurance information.

TGC said it had no reason to believe that any information was misused. The practice encouraged victims to closely monitor credit reports and account statements.

“Upon learning of the incident, TGC promptly contained the incident by securing the email accounts to prevent further access. It also engaged a forensic security firm to investigate and confirm the security of its email and computer systems and has adopted additional security enhancements,” the notice stated. 

“TGC is notifying all impacted individuals for whom it has a valid mailing address and has arranged for complimentary identity protection and credit monitoring services for certain individuals.”