Trinitas Regional Medical Center Vendor Reports Patient Cyber Security Incident
Trinitas Regional Medical Center (TRMC) has received notification that one of its vendors was affected by the MOVEit ransomware attack, leading to an unauthorized user gaining access and potentially extracting TRMC patient information. TRMC’s computer systems were not impacted.
CBIZ KA Consulting Services, LLC (CBIZ KA) provides revenue assistance, Medicaid eligibility, and compliance solution services to TRMC.
On May 31, 2023, Progress Software, the publisher of the MOVEit® Transfer secure file transfer platform, disclosed a zero-day vulnerability in their MOVEit software. CBIZ KA uses MOVEit Transfer to securely transfer data files in the normal course of business. CBIZ KA promptly launched an investigation, with the assistance of cybersecurity professionals, into the nature and scope of the MOVEit vulnerability. Through the investigation, CBIZ KA learned that an unauthorized party accessed a MOVEit Transfer server between May 29 and June 5, 2023, and downloaded certain files.
On September 14, 2023, CBIZ KA provided TRMC with the results of its review. Since that time, CBIZ KA and TRMC worked to confirm which patients were affected and to confirm patient contact information. The type of information that may have been impacted could vary by patient and could include social security number, date of birth, date of service, doctor’s or provider’s name, health insurance group and/or member number, information related to medical treatment or diagnosis, medical record number, Medicare or Medicaid number, patient account number, and/or treatment cost information.
CBIZ KA is notifying impacted patients of this incident via mailed letters that include an explanation of available services, resources and recommendations for patients to monitor any potential inappropriate use of their personal information. We have no evidence that any patient information has been misused.
A dedicated, toll-free call center has been established by CBIZ KA to answer questions about this incident, which can be reached at 866-547-6907, Monday through Friday from 9:00 am to 6:30 pm Eastern Time (excluding U.S. holidays).