Valley Baptist
Medical Center
Informational Website
This website is maintained by IDX on behalf of Valley Baptist Medical Center for the purpose of providing you with valuable services and information as a result of this situation
Notice of Data Security Incident
08/12/2022 — This notice provides information about a cybersecurity incident that affected Valley Baptist Medical Center – Brownsville and Valley Baptist Medical Center – Harlingen from which individuals may have received services at one of our locations in Texas (collectively “we”). We are committed to protecting your information. This commitment includes notifying you if we believe that an incident may have involved your personal information. This notice provides information about the incident and the resources available to you.
What Happened?
As part of an ongoing investigation, it was discovered on June 14, 2022, that an unauthorized third party was able to access personal information contained in a system within the network. This unauthorized activity occurred between March 31, 2022 and April 24, 2022. In response to this incident, user access to impacted information technology applications was immediately suspended, extensive cybersecurity protection protocols were executed, and steps were quickly taken to restrict further unauthorized activity. In parallel, an investigation of the incident was immediately launched, and a national forensic firm was engaged to assist with investigation and remediation efforts. Based on the data analysis that was performed and ultimately completed in early August 2022, we were able to determine which individuals may have had personal information in the impacted system. As a result of this review, it appears that your personal information may have been involved.
What information may have been involved?
Based on the review, the personal information may have included one or more of the following elements: (1) demographic information to identify you, such as full name and date of birth; (2) health insurance information, such as name of insurer/government payor, policy and/or group number; and (3) medical information, such as medical record number, patient account number, dates of service, provider and facility names, medications, and other visit, procedure and diagnosis information. Your Social Security number, driver’s license number, credit and debit card information, bank account information and account passwords were not involved in this incident. Please note that not all data elements were involved for all individuals.
What we are doing.
We take the security of personal information seriously. As soon as the incident was discovered, a forensic investigation was immediately launched, law enforcement was contacted, and steps were taken to mitigate and remediate the incident and to help prevent further unauthorized activity. In response to this incident, security and monitoring capabilities are being enhanced and systems are being hardened as appropriate to minimize the risk of similar incidents in the future.
Individuals affected by this incident are being mailed notice letters. Since it is possible there may be insufficient contact information for some individuals, however, we are posting this substitute notice on the Valley Baptist Medical Center – Brownsville and Valley Baptist Medical Center – Harlingen websites as permitted by HIPAA.
What you can do.
The Additional Resources section at the top of this page includes additional information on general steps you can take to monitor and help protect your personal information. Please review the Additional Resources. We also encourage you to carefully review statements sent from healthcare providers and insurance companies to ensure that all of your account activity is valid. Any questionable charges should be promptly reported to the provider or company with which you maintain the account.
For more information
For the next 90 days, if you have any questions about this matter or would like additional information (including which types of your data may have been involved), please call toll-free (833) 764-0237. This call center is open from 9 am – 9 pm Eastern Time, Monday through Friday, except holidays. This substitute notice and toll-free number will remain active for at least 90 days.
We deeply regret any concern this incident may cause you and want to assure you that we take this matter seriously.
Frequently Asked Questions
What Happened?
- What happened?
As part of an ongoing investigation, it was discovered on June 14, 2022, that an unauthorized third party was able to access personal information contained in a system within the network. This unauthorized activity occurred between March 31, 2022 and April 24, 2022. In response to this incident, user access to impacted information technology applications was immediately suspended, extensive cybersecurity protection protocols were executed, and steps were quickly taken to restrict further unauthorized activity.
In parallel, an investigation of the incident was immediately launched, and a national forensic firm was engaged to assist with investigation and remediation efforts. Based on the data analysis that was performed and ultimately completed in early August 2022, we were able to determine which individuals may have had personal information in the impacted system.
- When did the incident occur?
The event occurred between March 31, 2022 and April 24, 2022.
- Why am I only now being contacted?
Cybersecurity investigations and data review are very complicated and take time. It was important that a thorough investigation into the matter took place to confirm what happened, and identify those individuals who may have been impacted.
- Why does Valley Baptist Medical Center – Brownsville and/or Valley Baptist Medical Center – Harlingen have my information?
Based on the review, it appears you received services at one of our locations in Texas.
- What steps were taken when the incident was discovered?
As soon as the incident was discovered, a forensic investigation was immediately launched, law enforcement was contacted, and steps were taken to mitigate and remediate the incident and to help prevent further unauthorized activity. In response to this incident, security and monitoring capabilities are being enhanced and systems are being hardened as appropriate to minimize the risk of similar incidents in the future.
- What kind of information was exposed in this incident?
The personal information may have included one or more of the following elements: (1) demographic information, such as full name and date of birth; (2) health insurance information, such as name of insurer/government payor, policy and/or group number; and (3) medical information, such as medical record number, patient account number, dates of service, provider and facility names, medications, and other visit, procedure and diagnosis information. Social Security numbers, driver’s license numbers, credit and debit card information, bank account information and account passwords were not involved in this incident. Please note that not all data elements were involved for all individuals.
- Was I impacted by this incident?
Please call (833) 764-0237 to confirm whether your information was involved and for additional information.
- Was my Social Security number, driver’s license number, or financial account information involved?
No. Your Social Security number, driver’s license number, and financial account information were not involved in this incident.
- What is being done to prevent similar events from happening in the future?
As soon as the incident was discovered, a forensic investigation was launched, law enforcement was contacted, and steps were taken to mitigate and remediate the incident to help prevent further unauthorized activity. Enhancements are being made to security and monitoring capabilities and systems are being hardened as appropriate to minimize the risk of similar incidents in the future.
- What steps can I take to protect myself?
The Reference Guide included in the letter sent to you contains additional information on general steps you can take to monitor and help safeguard your personal information. If you believe you are the victim of a crime, you can contact your local law enforcement authorities and file a police report. The Reference Guide is also accessible in Additional Resources located at the top of this website.
- I received a letter in the mail. Is this fraudulent, a scam or a real incident?
Federal and state laws require notices to be provided to impacted individuals, including via letter. This incident did occur and thus the information and resources identified within the notification letter are being provided. You are encouraged to carefully review the Reference Guide included in your notification letter for more information on general steps you can take to monitor and help safeguard your personal information. Please call toll-free (833) 764-0237 if you have further questions or would like additional information.
- Who can I call if I have questions?
Please call toll-free (833) 764-0237 to ask questions and learn additional information. This call center is open from 9 am – 9 pm ET, Monday through Friday, excluding major U.S. holidays.
Minor Support Information
- Why can’t I pull my child’s credit report?
Most minors, under the age of 18, do not have a credit history established and are under the age to secure credit, therefore there is no credit report to pull.
- How can I check to see if someone has created a credit file using my child’s information?
TransUnion offers a secure online form that you can use to submit your child’s information to see if a credit file exists. Click here to go directly to the secure online form.
Additional information on child ID theft can also be found here.
Decedent Support Information
- What kind of coverage will the membership offer to someone who is deceased?
With this enrollment we will provide you, their legal representative, resolution assistance should they fall victim to fraudulent activity. The protection services apply to their identity, but the membership is truly there to support you if something were to happen.
- Why can’t I activate/authenticate the monitoring product for a deceased individual?
In most cases, decedents cannot be authenticated because the Social Security Administration or their legal representative (spouse, child, etc.) has already notified the credit bureaus that the person is deceased. If the credit bureaus have “frozen” the decedent’s credit files, the risk of identity theft has been significantly reduced.
Please know that the membership still provides recovery services to support you, their legal representative, if something was to happen; which is the real and true value.
- Is it possible to steal a deceased person’s identity?
Unfortunately, it is possible to steal the identity of someone who is deceased. Identity thieves obtain information about deceased individuals in various ways.
- How can someone steal a deceased person’s identity?
They may watch the obituaries, steal death certificates, or even get the information from websites that offer the Social Security Death Index file (which is actually intended for genealogy research).
- Does the Social Security Administration notify the credit bureaus and other financial institutions when someone is deceased?
Yes, but please be aware that it takes time for the Social Security Administration to conduct this notification, so financial institutions and the credit bureaus are not immediately made aware that a customer is deceased.
- Should I notify the credit bureaus when a dependent family member or spouse passes away?
Yes, you should immediately notify each credit bureau (Equifax, Experian, and TransUnion) in writing that the person is deceased and ask that a deceased alert be placed on their credit report.
- How do I place a deceased alert on the credit file?
You will want to notify each credit bureau (Equifax, Experian and TransUnion) in writing the following message:
“Deceased. Do not issue credit. If an application is made for credit, notify the following person(s) immediately: (list the next surviving relative, executor/trustee of the estate and/or local law enforcement agency- noting the relationship).”
Mail all correspondence via certified mail, return receipt requested. Be sure to keep photocopies of all correspondence, including letters that you send. Finally, you should also request a copy of the credit report.
Equifax
PO Box 740260
Atlanta, GA 30374Experian
PO Box 9554
Allen, TX 75013
(888)397-3742TransUnion
PO Box 2000
Chester, PA 19022- What documents will I need to send to the credit bureaus alerting them that the person is deceased?
You will need to include:
- A copy of the death certificate
- Name and SSN of deceased
- Last known address
- Date of birth
- Date of death
- Should I notify other financial institutions regarding the death?
Yes, immediately notify relevant credit card companies, banks, stock brokers, loan/lien holders, and mortgage companies of the death. The executor or surviving spouse will need to discuss all outstanding debts and how they will be dealt with. You will need to transfer the account to another person or close the account. If you close the account, ask them to list it as: “Closed. Account holder is deceased.” You may need to provide a copy of the death certificate to creditors as well as the credit bureaus. You should also notify utilities, phone companies, cell phone companies, etc, that you are terminating the account because the account holder is deceased.
- What happens if I do not notify the credit bureaus that the person is deceased?
Without a specific communication, the credit bureaus may not be aware of the death. An active credit file may stay open for up to 10 years without activity. During this time, an identity thief may use the decedent’s Social Security number to open up new lines of credit or apply for loans.
- What steps should be taken if I (surviving spouse or estate executor) suspect that someone is fraudulently using the information of a deceased person?
There are several steps that should be taken:
- You should request a copy of the decedent’s credit reports and place a “deceased alert” on the credit files
- You should also notify the police in the decedent’s jurisdiction and provide any evidence you have of the fraud (collection notice, bills, credit report)
- Notify any creditor, collection agency, credit issuer, utility company that the person is deceased and date of death. Be sure to include a copy of the death certificate. Request an immediate investigation and that they contact you with the results of the investigation. Insist on “Letters of Clearance,” which you should keep with the other estate papers.
- What should be done about joint accounts?
If there is a surviving spouse or other joint account holders, make sure to notify the company that the deceased’s name needs to be removed from the account. They may require a copy of the death certificate to do this, as well as permission from the survivor, or other authorized account holders.
- Is it possible to order a credit report for a deceased person?
If the credit bureaus have been notified of the deceased person’s death, it is not possible to order their credit report. The easiest way to determine this is to try to place a fraud alert for the deceased person. If the fraud alert is placed, then the bureaus have NOT been notified of the person’s death and ordering a report is possible. If you are informed that the fraud alert cannot be placed because the person is deceased, then you know that the bureaus have updated their records and that you will not be able to order a credit report.
Additional Resources
Review Your Account Statements
Carefully review statements sent to you from your healthcare providers, insurance company, and financial institutions to ensure that all of your account activity is valid. Report any questionable charges promptly to the provider or company with which you maintain the account.
Provide Any Updated Personal Information to Your Health Care Provider
Your health care provider’s office may ask to see a photo ID to verify your identity. Please bring a photo ID with you to every appointment if possible. Your provider’s office may also ask you to confirm your date of birth, address, telephone, and other pertinent information so that they can make sure that all of your information is up-to-date. Please be sure and tell your provider’s office when there are any changes to your information. Carefully reviewing this information with your provider’s office at each visit can help to avoid problems and to address them quickly should there be any discrepancies.
Order Your Free Credit Report
To order your free annual credit report, visit www.annualcreditreport.com, call toll-free at (877) 322-8228, or complete the Annual Credit Report Request Form on the U.S. Federal Trade Commission’s (“FTC”) website at www.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281. The three credit bureaus provide free annual credit reports only through the website, toll-free number or request form.
Upon receiving your credit report, review it carefully. Look for accounts you did not open. Look in the “inquiries” section for names of creditors from whom you have not requested credit. Some companies bill under names other than their store or commercial names; the credit bureau will be able to tell if this is the case. Look in the “personal information” section for any inaccuracies in information (such as home address and Social Security Number).
If you see anything you do not understand, call the credit bureau at the telephone number on the report. Errors may be a warning sign of possible identity theft. You should notify the credit bureaus of any inaccuracies in your report, whether due to error or fraud, as soon as possible so the information can be investigated and, if found to be in error, corrected. If there are accounts or charges you did not authorize, immediately notify the appropriate credit bureau by telephone and in writing. Information that cannot be explained should also be reported to your local police or sheriff’s office because it may signal criminal activity.
Contact the U.S. Federal Trade Commission
If you detect any unauthorized transactions in any of your financial accounts, promptly notify the appropriate payment card company or financial institution. If you detect any incidents of identity theft or fraud, promptly report the matter to your local law enforcement authorities, state Attorney General and the FTC. You can contact the FTC to learn more about how to protect yourself from becoming a victim of identity theft by using the contact information below:
Federal Trade Commission
Consumer Response Center
600 Pennsylvania Avenue, NW
Washington, DC 20580
1-877-IDTHEFT (438-4338)
www.ftc.gov/idtheft/
Place a Fraud Alert on Your Credit File
To protect yourself from possible identity theft, consider placing a fraud alert on your credit file. A fraud alert helps protect against the possibility of an identity thief opening new credit accounts in your name. When a credit grantor checks the credit history of someone applying for credit, the credit grantor gets a notice that the applicant may be the victim of identity theft. The alert notifies the credit grantor to take steps to verify the identity of the applicant. You can place a fraud alert on your credit report by calling any one of the toll-free fraud numbers provided below. You will reach an automated telephone system that allows flagging of your file with a fraud alert at all three credit bureaus.
Equifax
P.O. Box 105069
Atlanta, Georgia 30348
1-888-766-0008
www.equifax.comExperian
P.O. Box 9554
Allen, Texas 75013
1-888-397-3742
www.experian.comTransUnion
P.O. Box 2000
Chester, PA 19016
1-800-680-7289
www.transunion.com
Security Freezes
You have the right to request a credit freeze from a consumer reporting agency, free of charge, so that no new credit can be opened in your name without the use of a PIN number that is issued to you when you initiate a freeze. A security freeze is designed to prevent potential credit grantors from accessing your credit report without your consent. If you place a security freeze, potential creditors and other third parties will not be able to get access to your credit report unless you temporarily lift the freeze. Therefore, using a security freeze may delay your ability to obtain credit.
Unlike a fraud alert, you must separately place a security freeze on your credit file at each credit bureau. To place a security freeze on your credit report you must contact the credit reporting agency by phone, mail, or secure electronic means and provide proper identification of your identity. The following information must be included when requesting a security freeze (note that if you are requesting a credit report for your spouse, this information must be provided for him/her as well): (1) full name, with middle initial and any suffixes; (2) Social Security number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any applicable incident report or complaint with a law enforcement agency or the Registry of Motor Vehicles. The request must also include a copy of a government-issued identification card and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be legible, display your name and current mailing address, and the date of issue.
Below, please find relevant contact information for the three consumer reporting agencies:
Equifax Security Freeze
P.O. Box 105788
Atlanta, GA 30348
1-800-685-1111
www.equifax.comExperian Security Freeze
P.O. Box 9554
Allen, TX 75013
1-888-397-3742
www.experian.comTransUnion
P.O. Box 160
Woodlyn, PA 19094
1-888-909-8872
www.transunion.comOnce you have submitted your request, the credit reporting agency must place the security freeze no later than 1 business day after receiving a request by phone or secure electronic means, and no later than 3 business days after receiving a request by mail. No later than five business days after placing the security freeze, the credit reporting agency will send you confirmation and information on how you can remove the freeze in the future.
For Residents of North Carolina
You may also obtain information about preventing and avoiding identity theft from the North Carolina Attorney General’s Office:
North Carolina Attorney General’s Office, Consumer Protection Division, 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-919-716-6000, www.ncdoj.gov.