Data breach hits Atrium Health patients

CHARLOTTE, N.C. — Personal information for more than 2.5 million Atrium Health patients may have been compromised in a data breach of billing information, including addresses, dates of birth and Social Security numbers, the heath care giant said Tuesday.

A hacking affecting Atrium billing vendor AccuDoc may have affected as many as 2.65 million people, Charlotte-based Atrium said. Of those, about 700,000 patients may have had Social Security numbers compromised, according to Atrium.

Atrium Health, formerly Carolinas HealthCare System, operates 44 hospitals across North Carolina, South Carolina and Georgia. Atrium is the largest health care provider and employer in Charlotte.

Compromised patient information also includes insurance policy information, medical record numbers, invoice numbers, account balances and dates of service, according to a joint news release from Atrium and AccuDoc. Atrium emphasized that the information was accessed but not downloaded.

Medical records were not accessed, Atrium said, and neither were bank account or debit and credit card numbers.

AccuDoc, a Raleigh-area company that prepares bills and operates the website where patients can make payments online, became aware that a cyber incident took place on Oct. 1, according to the release. An “unauthorized third party” accessed the patient information between Sept. 22 and 29, the release said.

Atrium Health and AccuDoc said they began notifying patients of the hacking on Tuesday, nearly two months after they became aware of the incident.

“These are complicated investigations,” Atrium spokesman Chris Berger said Tuesday. “We’ve been working around the clock with AccuDoc, outside forensic investigators and the FBI to get to the bottom of this incident.”