Sometimes a data breach can be a quick strike and resolution, other times it’s a long game. In the case of UnityPoint Health-Allen Hospital, an employee was accessing files without authorization over the course of about seven years, taking in names, health insurance information, and in some cases Social Security numbers.

The Theft

The data breach was not done through a hack or malware, but rather from an internal source. According to The Courier, The employee in question was accessing records that she did not need or have authorization to obtain from September 2009 to March 2016. As the employee was allowed access to some patient information, she managed to access more without raising suspicion, hence the lengthy extent of the breach.

Approximately 1,620 patients were affected by this breach, and of those, around 15 percent had Social Security records on file and accessible. Other than that, the data provided names, addresses, birth dates, insurance information, and information related to the treatments they received.

The Fallout

Upon its discovery, Allen Hospital opened an immediate review, disabled the employee’s medical record access, and has reported the incident to the United States Department of Health and Human Services, as per the law. The employee committed a violation of the hospital’s patient privacy guideline, and can face civil or criminal penalties.

Allen Hospital has alerted all impacted patients, and is offering free membership for a credit monitoring service, along with information and guidance on other measures victims can take to protect themselves, such as fraud alerts and security freezes. To prevent future breaches from occurring, it’s implementing new targeted audits for employees.

When a data breach occurs through employee malice and theft, it can be harder to spot and stop in time, and can thus have wider or more disastrous consequences. With over a thousand patients impacted over the course of seven years, this was a pretty bad breach for the hospital, but hopefully one with minimized damage.

Photo by Presidencia de la República Mexicana