"We shut down our system right away," he said.
Officials from the
Instead, a two-month internal investigation found one of its own employees emailed spreadsheets containing patient information to a personal account on
More than 500 patients' names, ages, dates of service, diagnoses and medical record numbers were at risk.
Hospice announced the security breach
"We didn't go public right away because we didn't want to jump to conclusions," McHale said. "When we had a better grasp of the situation, we moved forward with informing everyone."
McHale said the results of the internal investigation have been turned over to
It could have been worse. Hospice, which helps people with long-term and terminal illnesses, has information on 5,000 patients, McHale said. He said it invests significant resources into securing that information.
"We actually have a very up-to-date system," he said.
The cost of protecting that data for health care organizations such as
"The biggest liability is when you leave work with the information," he said. "It's no longer protected and can be compromised."
Companies should also establish around-the-clock monitoring of their networks, allowing them to track a breach in progress.
It's not just careless employees that are a danger, Rhudy said, but hackers looking for vulnerabilities.
"It used to be that hackers would attack bigger companies," he said. "While they can still do that, they find it easier to go smaller."
Ireland said they keep everything in a single, in-house database of 3,500 donors, and only four people have access to it. Personal information on the nonprofit's 200 clients is protected by a series of firewalls.
"It could happen to anyone," Ireland said. "For us, it's important to stay ahead of the issue, so that doesn't happen."
McHale said about 2 percent of Hospice's patients and their families have expressed concern about the leak. The organization set up a call center to deal with questions.
"People are most concerned about what information may have been compromised," he said. "Once they learn it was nothing identifiable, many better understand the situation."
(c)2013 The Capital (Annapolis, Md.)
Visit The Capital (Annapolis, Md.) at www.hometownannapolis.com
Distributed by MCT Information Services