According to a statement, Sinai Health System (Sinai) became aware of a potential data security incident that may have resulted in the in advertent exposure of some patients’ personal and health information. On October 16, 2019, forensic information technology experts determined that patient information could be at risk after an unknown third party gained unauthorized access to two employee email accounts. 

Sinai says that experts performed an investigation and found no evidence that any patient information was removed from Sinai Health System’s email accounts or systems. In addition, Sinai says it is not aware of any misuse of any patient’s information and has seen no indication that any patient’s information is in the hands of someone it should not be as a result of this incident.

While experts found no evidence that any emails containing patient information were opened during the period of unauthorized access, Sinai identified the patients whose personal and health information were stored in the email accounts with help from outside computer experts. The information that could have been in the two email accounts includes patients’ names, addresses, dates of birth, Social Security numbers, health information or health insurance information. 

Sinai notes that it has taken steps to prevent a similar incident from occurring in the future, including resetting employee email passwords, conducting employee training and enhancing email filtering protocols. The healthcare provider says that it has also reviewed and revised its information security policies and procedures, including email retention procedures. Additionally, Sinai is increasing the security of its email systems and network with the assistance of security experts.