Protecting the privacy of personal information is of the utmost importance to Merritt Healthcare Advisors (“Merritt”), which recently notified individuals of a data security incident involving unauthorized access to one Merritt employee’s email account. Merritt is a healthcare advisory firm that provides services to healthcare organizations.
Upon learning of the issue, Merritt secured the account and commenced a prompt and thorough investigation in consultation with external cybersecurity professionals who regularly investigate and analyze these types of incidents.
After an extensive forensic investigation and manual document review, Merritt discovered on November 30, 2022 that some personal information was contained in the account that was accessed between July 30, 2022 and August 25, 2022. Merritt advised its client covered entities of this incident on January 13, 2023 and February 27, 2023. The accessed email account contained personal information of certain individuals including their names and some or all of the following: dates of birth, treatment information, provider names, medical record numbers/patient IDs, health insurance information, treatment cost information, and/or health insurance numbers. In addition, the account contained Social Security numbers and financial account information for a limited number of individuals.
Merritt has no evidence to suggest that any information has been acquired or misused as a direct result of this incident. Out of an abundance of caution, Merritt notified individuals whose information was included in the accessed account. Notified individuals have been provided with best practices to protect their information, including placing a fraud alert and/or security freeze on their credit files and obtaining a free credit report. Notified individuals should always remain vigilant in reviewing financial account statements and explanation of benefits statements and report any irregular activity. A credit monitoring membership has been offered to those individuals whose Social Security numbers were contained within the accessed account.
Merritt is committed to maintaining the privacy of personal information in its possession and has taken additional precautions to safeguard it. Merritt continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information.
For individuals who have questions or need additional information regarding this incident, or to determine if they are impacted, Merritt has established a dedicated toll-free response line at 1-833-753-4484. The response line is available Monday through Friday, 9 am to 9 pm Eastern Time.
This notification is being provided on behalf of the following covered entities:
Delaware Surgery Center
Kansas Spine and Specialty Hospital
Forest Surgery Center
Bakersfield Heart Hospital
New York GI Center