Geisinger data breach may have hit 1.2M patients

A data breach at Geisinger could have affected the personal information of more than 1.2 million individuals.

A former employee at Nuance Communications, which provides information technology services to Geisinger, allegedly accessed patient data two days after being terminated, the health system said in a news release.

Related: Is cybersecurity spending too low to prevent another Change breach?

Geisinger discovered the incident and alerted Nuance on Nov. 29, 2023, but law enforcement asked Nuance to delay patient notification to avoid impeding an investigation, the June 24 release said. The former employee was arrested and is facing federal charges, according to the release. 

Microsoft-owned Nuance determined the employee allegedly may have accessed information for more than 1 million Geisinger patients, the release said. A report submitted June 21 to HHS' Office for Civil Rights breach portal said 1,276,026 individuals were affected by the incident.

Potentially compromised information varied, but could have included names, dates of birth, addresses, admit and discharge or transfer codes, medical record numbers, phone numbers and facility name abbreviations. It may have also included race and gender information. Insurance information, credit card or bank account numbers and Social Security numbers were not accessed, according to the release.

Patients are encouraged to review their health plan statements to see if there are services listed that they did not receive.

Geisinger declined to provide information beyond what was included in the news release. A Microsoft spokesperson said Nuance is cooperating with law enforcement and taking necessary action to support its customer.

Geisinger, a $10 billion system, operates 10 hospital campuses and covers about 600,000 members through its health plan. It serves more than 1.2 million people across Pennsylvania. 

In April, Geisinger became the founding member of Risant Health, a Washington, D.C.-based nonprofit created by Oakland, California-based Kaiser Permanente to acquire health systems and build a national value-based care network.

Cybersecurity threats are becoming more common across the healthcare industry. Lurie Children's Hospital in Chicago reported last week a cyberattack in January affected nearly 800,000 individuals. St. Louis-based Ascension reported a ransomware attack in May, less than two months after a cyberattack brought Change Healthcare's operations — and much of the nation's insurance claims processing — to a halt.