Notice of Third-party Security Incident Impacting AtlantiCare Patient Data

Notice of Third-party Security Incident Impacting AtlantiCare Patient Data.

This notice provides information regarding a data breach incident. Intellihartx, LLC (“ITx”) is a healthcare revenue cycle company that focuses exclusively on healthcare clients. AtlantiCare uses ITx as part of its medical billing procedures. ITx notified AtlantiCare that we were among many organizations impacted by a cybersecurity attack their third party vendor, Fortra, LLC (“Fortra Event”) experienced.

ITx is notifying some AtlantiCare patients of the incident that might affect the privacy of some of their information. This notice provides details of the incident, ITx’s response, and steps you can take to protect against possible misuse of your personal information, should you feel it is appropriate to do so.

ITx says it is unaware of any misuse of our patients’ information with regard to the Fortra event.

However, we regret that this incident occurred and apologize for any concern it might cause. We take the confidentiality and security of our patients’ information seriously.

What happened?

• ITx reported that on February 2, 2023, it discovered that its secure file transfer protocol provider, Fortra GoAnywhere, was subject to a data privacy event that potentially impacted ITx clients’ patient information.

• ITx reported Fortra deleted the unauthorized party’s accounts, rebuilt the secure file transfer platform with system limitations and restrictions, and produced a patch for the software. 

• ITx reported it launched its own investigation to determine the nature and scope of the issue and implemented additional security measures around the use of the GoAnywhere platform.

• ITx says, it and Fortra have notified federal law enforcement about the Fortra Event.

• On May 19 ITx determined the scope of AtlantiCare patients whose data was accessed. ITx also confirmed that not every impacted individual had all of their possible data elements accessed.

What Information Was Involved?

ITx says based on information Fortra provided, ITx determined that one or more of the following patient information might have been present in the affected systems at the time of the Fortra Event: name, address, medical billing and insurance information, certain medical information such as diagnoses and medication, and demographic information such as date of birth and Social Security number.

What ITx is doing

ITx is mailing notice of this incident to those potentially affected individuals for whom it has contact information. ITx is also offering free credit monitoring through Experian IdentityWorks^SM to individuals potentially impacted by this event. ITx has a dedicated assistance line to assist you Monday through Friday, from 9 AM to 9 PM Eastern Time (excluding U.S. holidays). You can call this number, 1-833-901-4622 and please reference engagement number B096233. You can also write to ITx at P.O. Box 3404, Kingsport, TN 37664-3404 for additional information.

What you can do to protect your personal information

You can remain vigilant against incidents of identity theft and fraud by reviewing account statements and monitoring free credit reports for suspicious activity and to detect errors.

Under U.S. law, a consumer is entitled to one free credit report annually from each of the three major credit reporting bureaus, Equifax®, Experian®, and TransUnion®. To order your free credit report, visit annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also directly contact the three major credit reporting bureaus listed below to request a free copy of your credit report.

Consumers have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a one-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any one of the three major credit reporting bureaus listed below.

As an alternative to a fraud alert, consumers have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without the consumer’s express authorization. The credit freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a credit freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a credit freeze on your credit report. To request a security freeze, you will need to provide the following information:

1. Full name (including middle initial as well as Jr., Sr., II, III, etc.);

2. Social Security number

3. Date of birth

4. Addresses for the prior two to five years

5. Proof of current address, such as a current utility bill or telephone bill

6. A legible photocopy of a government-issued identification card (state driver’s license or ID card, etc.)

7. A copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft if you are a victim of identity theft.

Should you wish to place a credit freeze, please contact the three major credit reporting bureaus listed below: