Uintah Basin Healthcare, a rural health system in eastern Utah, notified 103,974 people that their personal and protected health information may have been taken during a network intrusion.
The organization said it detected suspicious activity on its network on November 7, 2022 and moved to secure its systems. The forensic review took months. On April 7, 2023 it concluded that patient data may have been accessed or copied during the incident, and notifications went out the following month.
The exposure covered patients treated between March 2012 and November 2022, a span of more than ten years. Information involved included names, addresses, dates of birth, Social Security numbers and health insurance details, along with clinical data such as diagnoses, medications, test results and procedure information.
Uintah Basin Healthcare said it engaged an outside cybersecurity firm, carried out a global password reset, deployed endpoint detection and response tooling and notified the FBI. It offered affected individuals 12 months of credit monitoring, dark web monitoring, identity theft insurance and recovery services through IDX, and said it had no evidence that any of the information had been misused.
Plaintiffs' firms announced investigations into the health system within days of the notification.