SoutheastHEALTH warns of potential data breach stemming from former vendor

SoutheastHEALTH put out a news release Thursday, June 22, stating the company learned of a potential data breach involving a former billing vendor, ITX.

The release stated a SoutheastHEALTH patient received a letter from ITX informing them of the "potential security issue".

A quote from the release said, "This breach did not occur within SoutheastHEALTH's IT (information technology) infrastructure. It was a potential occurrence from ITX, which provides billing services to hospitals nationwide. SoutheastHEALTH has no current business relationship with this vendor."

The release further stated ITX "could not confirm the release of any formal notification" of the breach to SoutheastHEALTH. Doing so is a requirement based on the HIPAA Breach Notification Rule, the release said

Per the release, SoutheastHealth recommends any patient who received this communication should follow directions specified in the letter.

ITX, self-described on its website as a "leading company in health care revenue cycle focused exclusively on health care clients with patient balances", lists a data breach involving its secure file transfer protocol provider, Fortra. The notice said officials learned of the breach in February and reviewed the incident, completing that review May 19. The post said ITX began notifying those potentially affected in April.

Information that could have been breached includes "name, address, medical billing and insurance information, certain medical information such as diagnoses and medication, and demographic information such as date of birth and Social Security number".

Those who may have been affected may call ITX at (833) 901-4622.