Data incident impacting Loyola University Medical Center Emergency Department patients

This notice pertains to a recent incident that may have affected a limited number of individuals involving email communications that contained Protected Health Information (PHI) related to care received at the Loyola University Medical Center Emergency Department (ED).

What happened

Between October 2023 and February 2024, a former administrative workforce member forwarded work-related content to their personal email account.

Upon discovery, Trinity Health promptly began a review to assess the nature and scope of the information involved. After the review concluded that PHI may have been included in the email communications, additional forensic investigation was required to confirm potentially affected individuals, which contributed to the delayed timing of this notification.

This action is a direct violation of Trinity Health policies and procedures. Despite Trinity Health’s best efforts, we have been unable to confirm that the forwarded information has been deleted from the workforce member’s personal email account.

What information was involved

The emails primarily contained images of Emergency Department patient listings. This information is used for operational purposes in the Emergency Department. The information disclosed varies and may have included patient identifiers and clinical or administrative details associated with an Emergency Department visit, including but not limited to name and age, reason for visit, location within the department, treating provider, and insurance-related information.

Based on our review, the information was maintained in a format or manner that has a low likelihood of misuse. However, we are offering complimentary credit monitoring services as a precautionary measure.

What we are doing and what you can do

In response to this incident, Trinity Health implemented changes to administrative workflows and processes and is reviewing procedures related to email use.

Loyola University Medical Center regrets this incident and any concern it may cause.

Because the privacy and security of your health information is important to us, we are providing complimentary credit monitoring to potentially affected individuals. If you have questions about this incident or would like to enroll in these services, please contact the dedicated assistance line at 1‑844‑593‑9681, Monday through Friday, 7:00 AM to 7:00 PM CT, excluding holidays. Additionally, it is always prudent to review credit reports/account statements and health care statements for accuracy and report any services or charges that were not incurred to the company, provider or insurance carrier.

Please note that when signing up for monitoring services, you may be asked to verify personal information for your own protection to confirm your identity.

Reference Guide

Review Your Account Statements

Carefully review statements sent to you from your healthcare providers, insurance company, and financial institutions to ensure that all of your account activity is valid. Report any questionable charges promptly to the provider or company with which you maintain the account.

Order Your Free Credit Report

You may also periodically obtain credit reports from the nationwide credit reporting agencies. If you discover information on your credit report arising from a fraudulent transaction, you should request that the credit reporting agency delete that information from your credit report file. In addition, under federal law, you are entitled to one free copy of your credit report every 12 months from each of the three nationwide credit reporting agencies. You may obtain a free copy of your credit report by going to www.AnnualCreditReport.com or by calling (877) 322-8228. You may contact the nationwide credit reporting agencies at:

You also have other rights under the Fair Credit Reporting Act (“FCRA”). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For information about your rights under the FCRA, please visit: https://files.consumerfinance.gov/f/201504_cfpb_summary_your- rights-under-fcra.pdf.

Contact the U.S. Federal Trade Commission

You may contact the Federal Trade Commission (“FTC”), law enforcement, or your state Attorney General to report incidents of identity theft or to learn about steps you can take to protect yourself from identity theft. To learn more, you can go to the FTC’s website at www.ftc.gov/idtheft, or call the FTC at (877) IDTHEFT (438-4338) or write to Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580.

Fraud Alerts and Security Freezes

You may obtain additional information from the FTC and the credit reporting agencies about fraud alerts and security freezes. You can add a fraud alert to your credit report file to help protect your credit information at no cost to you. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to verify your identity. You may place a fraud alert in your file by calling any of the nationwide credit reporting agencies listed above. As soon as that agency processes your fraud alert, it will notify the other two agencies, which then must also place fraud alerts in your file.

You can also contact the nationwide credit reporting agencies at the numbers listed above to place a security freeze to restrict access to your credit report free of charge. You must separately place a credit freeze on your credit file at each credit reporting agency. You will need to provide the credit reporting agency with certain information, such as your name, address, date of birth and Social Security number. After receiving your request, the credit reporting agency will send you confirmation containing a unique PIN or password that you will need in order to remove or temporarily lift the freeze. You should keep the PIN or password in a safe place. If you request a lift of the credit freeze online or by phone, the credit reporting agency must lift the freeze within one (1) hour. If you request a credit freeze or lift of a credit freeze by mail, the credit reporting agency must place or lift the credit freeze no later than three (3) business days after getting your request.

State Specific Information

For residents of the District of Columbia, Iowa, Maryland, New York, North Carolina, Oregon and Rhode Island, you may contact your Attorney General for additional information about avoiding identity theft. If you are a Rhode Island resident, you may also file a police report by contacting local or state law enforcement agencies.

You may use the following information to contact your attorney general:

For residents of Massachusetts: Under Massachusetts law, you have the right to obtain any police report filed in connection to the incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.

For residents of New Mexico: You have rights under the federal Fair Credit Reporting Act (FCRA). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For more information about the FCRA, please visit https://files.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf or www.ftc.gov.