Nuvance Health and Sharon Hospital hit in Blackbaud data security breach

Nuvance, the parent company of Sharon Hospital, announced to patients  between Sept. 11 and 21 that the health care system had been part of a massive “data security incident” involving Blackbaud, a software company that serves nonprofits. 

The incident occurred in July; many companies announced that they had been impacted by it in August. Nuvance (and some other companies) waited until now to make the announcement because, according to Andrea Rynn, director of Public and Government Relations at Nuvance Health, “Once we were notified, we undertook our own careful investigation which, as you might imagine, took some time to complete. We began notifications the week of Sept. 11.”

The announcements to individual clients were sent in letters that differed depending, Rynn said, “on whether a person was a current or past donor, potential donor, a minor or the estate of someone deceased.”

The security breach involved not only donations to the nonprofit health-care system but also, according to a Sept. 21 announcement on the Nuvance website, “may have included name, contact information, age, gender, date of birth, admission date, the department [patients] were treated in, treating physician and health insurance status.”

Nuvance stressed that “Blackbaud has informed us that Social Security numbers, financial account and credit card information was encrypted, and therefore not able to be accessed by the unauthorized individual.”

Rynn said that, “This incident did not affect any of our systems. Rather, the incident occurred at our third party vendor, Blackbaud.”

There are now questions, of course, about whether Blackbaud should be trusted with confidential information about donors and health system patients.  

“Blackbaud informed us that they have taken steps to remediate the issue,” Rynn said. “To help prevent something like this from happening again, we are reevaluating our relationship with Blackbaud and closely monitoring its continued updates and the security measures it implemented in response to the incident.”

Nuvance has set up “a dedicated call center to answer any questions about this incident, at 866-968-0208, from 8 a.m. to 5:30 p.m. Monday through Friday, excluding major U.S. holidays” such as the upcoming Indigenous Peoples Day.

As a precaution, anyone who has had financial or patient dealings with Sharon Hospital or other Nuvance health centers should “review the statements you receive from your healthcare providers. If you see services you did not receive, please contact the provider that issued the statement immediately.”