LHC Group, a home health and hospice provider owned by UnitedHealth Group’s Optum, has disclosed a data breach tied to a vishing attack that exposed patient information.
LHC Group said it became aware April 7 that an employee may have fallen victim to a voice phishing scheme, according to the September notice. The company’s third-party technology vendor, which supports referral management, care coordination and clinical workflow functions, subsequently flagged suspicious activity tied to an LHC user account.
An investigation determined a threat actor stole credentials and accessed a large volume of files containing patient protected health information on the vendor’s platform. The unauthorized access occurred from April 7 to April 15, and LHC Group began confirming the identities of affected individuals July 9.
Exposed data may have included patient names, addresses, dates of birth, clinical summaries, treatment plans, diagnosis codes, dates of service, provider information, health insurance details and Medicare or Medicaid ID numbers. Social Security numbers and financial information were involved in limited instances, according to the notice.
The breach was reported to HHS’ Office for Civil Rights on Sept. 4 with an initial figure of 500 affected individuals, a placeholder count that companies commonly file while a review is ongoing and that may rise as LHC Group’s investigation continues. OCR posted the figure later in the month.
LHC Group disabled the compromised account, notified the FBI, engaged third-party forensic experts and is offering two years of free credit monitoring and identity protection through IDX. The company said it has no evidence the information has been misused.
LHC Group, with about 30,000 employees across dozens of states, became part of UnitedHealth Group’s Optum in 2023 as part of a $5.4 billion acquisition.
At the Becker's 5th Annual Fall Payer Issues Roundtable, taking place November 2–3 in Chicago, payer executives and healthcare leaders will come together to discuss value-based care, regulatory changes, cost management strategies and innovations shaping the future of payer-provider collaboration. Apply for complimentary registration now.
