Health New England (“HNE”) is committed to protecting the confidentiality and security of member information. Regrettably, this notice concerns an incident involving some of that information.
Northwood, Inc. (“Northwood”) is a supplier of durable medical equipment, prosthetics, orthotics, and other medical and health-related supplies. Northwood works with several healthcare plans, including HNE, and manages and arranges for durable medical equipment for our plan members. To help accomplish this function, Northwood receives certain member information. On May 6, 2019, Northwood became aware of suspicious activity relating to a Northwood employee’s email account. Northwood immediately launched an investigation to determine the nature and scope of the incident and a leading computer forensics expert was engaged to assist. The investigation determined that an unauthorized individual or individuals accessed the Northwood employee’s email account between May 3 and May 6, 2019. Because Northwood was unable to determine which email messages in the account may have been opened or viewed by the unauthorized individual, Northwood reviewed the contents of the entire email account to identify what personal information was stored within it. On June 11, 2019, Northwood notified us that it determined the affected email account contained information related to HNE members that received durable medical equipment either supplied or managed by Northwood. The information included members’ names, addresses, dates of birth, provider names, medical device descriptions, diagnosis code(s), treatment information, and member health plan identification numbers.
This incident did not affect all of HNE’s members; but only those members who had information contained in the affected Northwood employee email account.
Northwood does not have any evidence that member information was actually accessed or viewed by the unauthorized individual, or that it has been misused. However, out of an abundance of caution, Northwood began mailing notices on July 16, 2019 to affected individuals, including HNE members, whose information was identified in the account. Northwood has also established a dedicated toll-free call center to answer questions members may have about the incident. If you have questions, please call 1-800-494-0297 (toll free), Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern.
We recommend members review any billing statements or explanation of benefits statements that they receive from their health insurer and any healthcare provider. If you see services you did not receive, charges that do not match up with your care, or other activity on your health plan account that you do not recognize, please contact the insurer or provider immediately.
We regret any concern or inconvenience this incident may cause. We and Northwood remain committed to protecting the confidentiality and security of our members’ information. To help prevent something like this from happening in the future, Northwood implemented mandatory password resets for all employee email accounts and notified employees to be on the lookout for suspicious emails. Northwood also implemented additional technical safeguards on its email system, as well as training and education for its employees in order to prevent similar future incidents.