UNC Health Notifies 946 Patients of Potential Privacy Issue

MORRISVILLE, N.C.--(BUSINESS WIRE)--UNC Health announced today that it is mailing letters to 946 patients to notify them that certain limited billing information associated with their account may have been accessed by another person without appropriate authorization.

On Sept. 9, 2021, UNC Health initiated an internal review of billing fields in its electronic medical record system. One of the billing fields in the electronic medical record system can be used to identify an individual who is authorized to have access to the patient’s billing information. By listing an individual in this field, the individual can then electronically access certain limited billing information associated with the patient. Typically, the individual listed in the field is a relative of the patient or someone else who has appropriate access to the patient’s billing information. Following UNC Health’s review, it was not able to conclusively determine, in 946 cases, that the individual named in the patient’s account was in fact authorized to access the patient’s billing information. Although UNC Health believes that with respect to many of the 946 cases, the individual listed may be a relative or someone who does appropriately have access to the patient’s billing records, UNC Health is notifying all 946 patients of the issue.

Information accessed by the individual named in the patient’s account includes demographic information (such as patient name and address) and limited clinical information (such as dates of service and a brief description of the services provided on those days) as well as information about the charges and payments related to these services. No credit card, debit card, or bank account numbers, driver’s license numbers, insurance identification numbers, or Social Security numbers could have been or were accessed. Accordingly, UNC Health has no reason to believe that any affected patient is or will be at financial risk as a result of this issue.

In response to this issue, UNC Health has cleared and reset this field in its electronic medical record system so that anyone who was previously authorized to access the patient’s billing information by being listed in this field will no longer have such access. Patients were also provided with instructions on how to re-establish access to their billing information for the named individual. Additionally, UNC Health has changed its electronic medical records system administration to limit the staff members who have access to update this field and have re-trained the staff members who will continue to have access to update this field.

UNC Health is committed to protecting the privacy and security of patient information and has developed and implemented numerous safeguards in furtherance of this commitment. The steps being taken in response to this issue will help prevent a similar issue from recurring.

If patients have any questions about this incident, they should call the UNC Health Privacy Office at 984-974-1069, Monday through Friday, between 8:30 a.m. and 5:00 p.m., Eastern Time.