CHS Hospital Network Victim of Hackers

Lock Haven Hospital Impacted

FRANKLIN, Tenn.—It’s been a difficult August for Community Health Systems Inc., owner of the Lock Haven Hospital.

On Monday of this week CHS acknowledged that personal data for some 4.5 million patients nationwide had been hacked in a cyber attack traced to China.

Through a filing with the Securities and Exchange Commission the company said the personal data included names, addresses and Social Security numbers.

The local impact was detailed in a release on Monday from the Lock Haven Hospital:

“Limited personal identification data belonging to some patients who were seen at Lock Haven Clinic company physician offices, over the past five years was transferred out of our organization in a criminal cyber-attack by a foreign-based intruder. The transferred information did not include any medical information or credit card information, but it did include names, addresses, birthdates, telephone numbers and social security numbers.

We take very seriously the security and confidentiality of private patient information and we sincerely regret any concern or inconvenience this event may cause for our patients. Though we have no reason to believe that this data would ever be used, all affected patients are being notified by letter and offered free identity theft protection.

Our organization believes the intruder was a foreign-based group out of China that was likely looking for intellectual property. The intruder used highly sophisticated methods to bypass security systems. The intruder has been eradicated and applications have been deployed to protect against future attacks. We are working with federal law enforcement authorities in their investigation and will support prosecution of those responsible for this attack.

Many American companies and organizations have been victimized by foreign-based cyber intrusions. It is up to the Federal Government to create a national cyber defense that can prevent this type of criminal invasion from happening in the future.”

CHS, a publicly traded hospital operator earlier this month agreed to pay $98 million to settle U.S. Justice Department allegations it knowingly billed government health care programs “for inpatient services that should have been billed as outpatient…services.”

CHS has 206 affiliated hospitals in 29 states, including more than 20 in Pennsylvania.