Based on information provided by law enforcement on July 18, 2012, the University of Miami Health System conducted an investigation that revealed that two University of Miami Hospital employees were inappropriately accessing patient information, specifically registration “face sheets,” and may have sold them. These two employees were terminated immediately. The University of Miami Health System delayed public notice at the request of law enforcement to avoid hindering the criminal investigation.
Face sheets contain basic identifying information, including name, address, date of birth, insurance policy numbers, and the reason for the visit. While social security numbers are masked to display only the last four digits, some health insurance plans, such as Medicare and Medicaid, continue to use social security numbers as insurance policy numbers, which are included on the face sheet.
In an abundance of caution, we are notifying patients who may have been seen at University of Miami Hospital between October 2010 and July 2012. This incident has no impact on your care. University of Miami Hospital computer systems are completely unaffected. Your information remains current and available; no information was altered or deleted. Please be assured we are committed to protecting all information entrusted to us.
In an effort to mitigate any harm that could result from fraudulent identity-related activities, we are offering a complimentary two-year membership to Experian’s ProtectMyIDTM Elite. This product helps detect possible misuse of your personal information and provides you with superior identity protection services focused on immediate identification and resolution of identity theft.
Once your ProtectMyID membership is activated, your credit report will be monitored daily for 50 leading indicators of identity theft. You’ll receive timely Surveillance Alerts™ from ProtectMyID on any key changes in your credit report, a change of address, or if an Internet Scan detects that your information may have been found in an online forum where compromised credentials are traded or sold.
ProtectMyID provides you with powerful identity protection that will help detect, protect and resolve potential identity theft. In the case that identity theft is detected, ProtectMyID will assign a dedicated U.S.-based Identity Theft Resolution Agent who will walk you through the process of fraud resolution from start to finish for seamless service. We realize that identity theft can happen months and even years after a data breach. To offer added protection, you will receive ExtendCARETM, which provides you with the same high-level of Fraud Resolution support even after your ProtectMyID membership has expired.
You will need to activate this membership no later than January 5, 2013, which will then continue for 24 full months. You will not receive the benefits of ProtectMyIDTM Elite unless you enroll.
To address possible concerns of our patients about this situation, a website has been set up at www.umh.dataincident.med.miami.edu to serve as the primary source of information. A toll-free number also has been established at 877-534-7033 to answer any additional questions. This toll-free incident line will be available from 9 a.m. to 9 p.m. EST Monday through Friday, and 11 a.m. to 8 p.m. EST Saturday and Sunday until January 05, 2013.
The University of Miami Health System is cooperating fully with law enforcement, which continues to investigate this incident. We will continue to review our practices to determine what additional steps are necessary to avoid such incidents in the future. We apologize for any inconvenience this incident may have caused. We deeply appreciate being entrusted with your care, and we want to assure you that protecting patient information is a top priority for the University of Miami Health System.
Chief Executive Officer
University of Miami Hospital
* Identity theft insurance is underwritten by insurance company subsidiaries or affiliates of Chartis, Inc. The description herein is a summary and intended for informational purposes only and does not include all terms, conditions and exclusions of the policies described. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions.