Veterans health administration notifying veterans of potential information disclosure | va boston health care | veterans affairs

BOSTON , MA — The Veterans Health Administration (VHA) is sending letters to 2,302 Veterans notifying them of the potential disclosure of protected health information that may have been

obtained through the cyber security attack on a server managed by a contracted medical transcription vendor, DBP, Inc. The affected transcribed documents contained some or all the following

information: full name, medical record information, or social security number.  VHA employees conducted a thorough investigation regarding this incident and determined this cyber security

attack did not affect any medical record information in the VA electronic health record.  We determined that this attack involved the files on the DBP, Inc. server being “locked down”

(encrypted) and potentially copied by the offending malicious party. The vendor was able to shut down the server and disconnect it from the internet to prevent further attacks. The vendor

purchased new hardware and implemented new security controls on the equipment. The Department of Veterans Affairs continues to work with the vendor to ensure appropriate security measures

are in place. In VISN 1: 386 Veterans from VA Boston Healthcare System, 37 Veterans from VA Connecticut Healthcare System, and 144 Veterans from VA Togus Healthcare System were affected. In

VISN 5: 25 Veterans were affected from Baltimore VA Medical Center. In VISN 17: 1,069 Veterans were affected from VA Amarillo Healthcare System. In VISN 23: 616 Veterans were affected from

VA Minneapolis Healthcare System. Veterans affected will receive a Privacy Notification Letter containing details on what information was at risk. Veterans who have questions or concerns

about whether their personal information may have been involved can call and leave a message at 1-844-838-5433 between the hours of 8:00 a.m. and 4:30 p.m., Monday through Friday. Calls will

be returned by privacy officers at the local VA medical centers within two business days.