INDIANAPOLIS — Community Health Network announced Saturday that it is notifying patients of a data breach involving one of its affiliates.
According to Community, they have no indication that Social Security numbers, account numbers, or credit card information was collected or transmitted during the breach.
Patients of Fishers Digestive Care may have had their data transmitted to website tracking technology vendors, such as Facebook (Meta) and Google, through Community's MyChart patient portal. Community announced a similar breach regarding its own websites in November and found that Fishers Digestive Care was also impacted.
Community uses tracking technologies or “cookies” and “pixels” on some of its websites to improve access to critical patient care services and manage key functions of patient-facing websites. Many other healthcare organizations commonly employ similar technologies throughout the United States.
When Community learned about the tracking technology in MyChart, it immediately began working with its service providers to disable and/or remove certain technologies from its websites and applications and continued to investigate to better understand what information was collected and transmitted.
Community determined that the type of information varied depending the user’s device and their activity within MyChart. Only certain data fields in MyChart transmitted information that was tracked, but the investigation was unable to determine the extent of each user's interaction and what data was tracked.
Information that could have been tracked may include computer IP address; dates, times, locations and types of medical appointments or procedures scheduled; information about a patient's health care provider and communications through MyChart. Names and medical record numbers, insurance may have also been tracked.
Community disabled and/or removed all third-party tracking technologies on MyChart.
Community reported the breach to federal regulators and is contacting anyone potentially impacted by this incident to advise them of the steps they can take to protect themselves from website tracking, which includes changing the privacy settings on their devices to block or delete cookies or by using browsers that support privacy-protecting operations, as well as adjusting privacy settings on any Facebook or Google accounts.
Community is sending letters to all patients who have engaged with Fishers Digestive Care on or after January 1, 2020, which is the date Community began implementing third-party tracking technologies within MyChart.
Information about the incident is available in the letters mailed to patients or by calling (866) 361-5593 between 9 a.m. and 7 p.m. ET, Monday through Friday.
