Medical College of Wisconsin alerts patients about security incident involving employee email account

"On July 5, 2016, the Medical College of Wisconsin noticed unusual activity associated with an employee’s email account. Immediately upon discovering the issue, they took action to prevent further access. They also simultaneously began an investigation and retained an independent computer forensic firm to investigate this abnormal activity. On August 3, 2016, the forensic investigation determined that an unauthorized third-party had accessed the email account over a limited three day period from July 2, 2016 to July 4, 2016. The forensic firm also confirmed that the incident did not impact the security of any other MCW email accounts, networks or servers.

"After completion of the forensic investigation, MCW devoted considerable time and effort to determine exactly what information was contained in the affected email account and at risk of disclosure. They conducted a sophisticated review of each document in the email account to ensure accuracy and confirm those potentially impacted. The email account in question contained full names, dates of birth, home addresses, medical record numbers, and codes or notes related to diagnosis or treatment provided. Also, the Social Security numbers of 2 patients were included in the email account. No health insurance, credit card, banking or other financial information was contained in the email account."