Notice of Data Breach
At Sandhills Medical Foundation, Inc., we value our patients and their privacy. This notice is to inform our patients about an incident that involved their personal information.
Sandhills Medical Foundation, Inc. (“Sandhills”) uses an outside vendor to provide electronic data storage for some of its scheduling, billing, and reporting systems. On January 8, 2021, the vendor informed Sandhills that the vendor experienced a ransomware attack that affected Sandhills’ systems and the data stored in them. The vendor’s investigation showed that the attackers used compromised credentials to access their system on September 23, 2020. The attackers accessed Sandhills’ systems on November 15, 2020, and exfiltrated (took) Sandhills’ data before the ransomware attack was launched on December 3, 2020.
What Information Was Involved
Sandhills determined that patient medical records, lab results, medications, credit card numbers and bank account numbers were NOT affected. The affected data included patient names, dates of birth, mailing and email addresses, driver’s licenses, and Social Security numbers. It also included claims information which could be used to determine patient diagnoses/conditions.
What We Are Doing
The vendor reported the attack to law enforcement and hired a cybersecurity firm to investigate and respond to the attack. The vendor paid the attackers to return the data and received assurances that copies of the data were deleted/destroyed. Since the attack, the vendor has implemented additional security measures.
Sandhills reported the breach to the U.S. Department of Health and Human Services, Office for Civil Rights; to the South Carolina Department of Consumer Affairs; and to the national credit reporting agencies. Sandhills sent a letter to each affected patient describing the incident and offering one year of free credit monitoring and identity theft protection.
For questions about how to enroll in the free credit monitoring and identity theft protection services, affected patients should call 1-888-236-0854. To speak directly with Sandhills’ Compliance Officer about this incident, patients should call 1-800-688-5525.