Over 1 million patients’ information is at risk after the latest data breach on Michigan health care facilities.
A recent cyberattack on a Corewell Health vendor facility breached the data of over 1 million patients in the state, Attorney General Dana Nessel announced Tuesday.
“Health information is some of the most personal information we have,” Nessel said. “Michigan residents have been subjected to a surge of health care-related data breaches and deserve robust protection.”
The incident happened at HealthEC, LLC, a Corewell Health vendor in Lansing. HealthEC sent notice letters to affected patients on Dec. 22. Though not required under state law, Corewell Health reported the breach to the state attorney general’s office before publicly announcing the incident.
Data breaches include medical information, Social Security numbers, birthdates, health insurance information, medical record numbers, and more.
The breach also impacted a smaller number of Beaumont ACO patients, which has a separate contract with HealthEC. HealthEC sent out a separate patient notice to this group.
This incident marks the second Corewell Health data breach in recent months after a previous incident in November.
In 2023, there have been several other cyberattacks in the state, including on 2.5 million McLaren Health Care patients in late August. A federal database shows over 30 cyberattacks across the state in 2022 and 2023.
More: Hacking is a threat to all: What you can do to prevent it
Affected patients are eligible for 12 months of credit monitoring and identity protection services from Health EC through TransUnion.
Nessel called on state lawmakers to pass legislation requiring companies to immediately report data breaches to the state’s Department of the Attorney General. Data breaches involving personal health information are required to be reported to the U.S. Department of Health and Human Services Office for Civil Rights under HIPAA.
The Michigan Department of Attorney General provides consumers with information in its Data Breaches: What to do Next alert.
