Community Health of Central Washington (CHCW) is providing this notice to keep our patients, and the communities in which we operate, fully aware of important events involving our medical facilities.
On November 9, 2019, an individual who was a CHCW employee at that time, improperly emailed patient information from the employee’s CHCW email account to the employee’s personal Gmail account.
This limited and improper data breach included information on approximately 460 patients, with the vast majority living in the Ellensburg area. All identified patients have been individually notified.
The improper email contained two types of information: The first type was personal notes of the former employee. The second type was work-related notes regarding patients. It was this second type of notes, the patient-related notes, that we are concerned about.
CHCW became aware of this incident on December 6, 2019, the day after the employee resigned. CHCW has strict policies about protecting the security and confidentiality of the patient information we maintain, and the former employee’s actions were in clear violation of these policies.
Once we became aware of this incident, we immediately commenced an internal investigation, which is ongoing, as of the posting of this website information. We also notified the Ellensburg Police Department and it opened an investigation regarding the incident. The Ellensburg Police Department investigation is also still ongoing, as of the posting of this website information. As of the date of this website posting, we have no reason to believe that any of the patient information sent in the improper email has been misused as a result of this incident. However, out of an abundance of caution, we want to provide this information to the public and assure you that we take this matter very seriously.
On February 3, 2020, letters regarding this matter were sent to the patients involved. Those letters contained a full explanation of the situation and offered the patients the opportunity to contact CHCW with any questions or concerns.
The vast majority of the patient-related information contained in the improper email included very minor points of information, such as first names, last initials, and initials and a phone number. The other health information of our patients that may have been impacted by this incident may have included a patient’s full name, date of birth, phone number, and medical record information including dates of service, diagnosis and treatment information. For two patients, social security numbers were involved. The improper email did not include any drivers’ license data, financial information, credit card data, or bank information.
We have and will continue to take steps to mitigate this incident and to help prevent this type of incident from happening again. For example, we reminded our staff about our email usage and patient privacy policies, and we are planning additional privacy and security training for all staff to prevent this type of incident from happening in the future. In addition, we are reviewing and updating our policies and procedures regarding data privacy and security.
Again, based on our investigation, as of the posting of this website information, we have no reason to believe that any personal information has been misused as a result of this incident, including for purposes of identity theft.
As all identified patients have been individually notified, we ask them to consider taking appropriate steps to help protect their identity. The letter included recommendations by the Federal Trade Commission regarding identify theft protection, and details on how to place a fraud alert or a security freeze on their credit file.
We sincerely apologize and regret that this incident occurred. Our patients’ trust is important to us, and we take our responsibility to protect our patients’ personal information very seriously. Please be assured that CHCW is taking steps to ensure that an issue of this nature will not happen in the future. If you have questions regarding this matter, please call 866-977-0036 Monday through Friday, from 8:00 a.m. to 6:00 p.m.
