A notice to our patients
Great Plains Health (GPHealth) values the privacy and security of our patients’ information. Regrettably, this notice concerns a security incident that may have involved some of that information for a limited number of patients.
The Nebraska Medical Center (Nebraska Medicine) provides some technical services to GPHealth and, as part of those services, creates and maintains a limited number of documents containing our patients’ information.
On September 20, 2020, Nebraska Medicine identified unusual network activity that affected some of its IT systems. Immediately upon learning of the incident, Nebraska Medicine initiated its incident response protocols to minimize any disruption to patients, isolated potentially impacted devices and shut off certain systems as a precaution. Nebraska Medicine also initiated an investigation, engaged computer forensic experts to assist with its ongoing investigation and notified law enforcement.
Based on the findings of the investigation, Nebraska Medicine confirmed that an unauthorized person gained access to certain systems on the network between August 27, 2020 and September 20, 2020. During that time, the unauthorized person deployed malware and acquired copies of some patient information held on those systems. Nebraska Medicine conducted a thorough review of the documents involved and, on January 11, 2021, confirmed that a small number of documents reflected GPHealth patient information The documents may have included patient demographic information (such as patient name, address, date of birth, medical record number), provider name, diagnosis codes, health insurance information and/or in some cases, financial information (such as social security number and/or financial account number). This incident did not result in any access to the Electronic Medical Record or our network.
This incident did not affect all GPHealth patients; only those patients whose information was included in the affected documents.
Nebraska Medicine has no indication that any patient information has been used to commit fraud as a result of this incident. However, in an abundance of caution, Nebraska Medicine is notifying impact patients on our behalf and providing them with guidance on how they can help protect their information. Nebraska Medicine also established a dedicated, toll-free call center to answer patients’ questions. If you have questions, please call 855.763.0482 between 8 a.m. to 5:30 p.m. Central Time, Monday through Friday. Nebraska Medicine is providing patients whose social security numbers were involved complimentary credit monitoring and identity theft protection services. GPHealth and Nebraska Medicine also recommend that affected patients review any statements they receive from their health care providers and health insurers and notify them immediately if they see any charges for services not received.
We deeply regret that this incident occurred and for any concern this may cause. To help prevent something like this from happening again, we are working with Nebraska Medicine to help ensure that systems are effectively protected.