Two months after a a cybersecurity incident that affected Palomar Health Medical Group, the health care agency is finally providing some transparency about the situation.
The medical group sent out a notice last Wednesday saying an incident on that date "may have impacted the privacy of information related to certain individuals."
Previous coverage:
It determined someone had access to certain files from April 23 to May 5. The medical group believes some files might have been copied.
Get top local stories in San Diego delivered to you every morning. >Sign up for NBC San Diego's News Headlines newsletter.
So far, PHMG says it cannot identify who was impacted or what specific information was involved. It believes it could be personal information, including Social Security numbers, medical histories and credit card numbers.
The medical group says it is unaware of any information being misused and it encourages patients to be vigilant against incidents of identity theft by reviewing account statements.
"The investigation is ongoing but has found that an unauthorized actor gained access to certain files within PHMG’s network from April 23, 2024, to May 5, 2024, and may have copied those files. Additionally, this incident may have caused certain files to become unrecoverable. However, PHMG is continuing its efforts to restore all files and identify the specific individuals and information that may have been impacted so it can provide individualized notice with additional information when its investigation is complete," the medical group said in its notice, in part.
PHMG says it cannot yet identify who and what information has been impacted or confirm if there has been misuse of that information.
The notice came as the deadline for a data breach requirement by the federal government was approaching. The rule states that health systems have 60 days from the discovery of a breach to notify patients, the media and the government about what information may have been compromised and what it's doing to fix the issue.
As the investigation continues, patients told NBC 7 they’ve had trouble making appointments, getting test results and refilling prescriptions. An internal email sent to employees a few weeks ago estimated that 85% of systems would be back online by July 1. That has not happened, according to the people NBC 7 spoke to.
NBC 7 reached out to the medical group last week, and in an email, it sent this statement: “Palomar Health Medical Group is working diligently to be fully operational by mid-July. We value our patients and appreciate their understanding and patience as we respond to this incident.”
Palomar Health Medical Group patients are not the only ones being impacted by the incident. An employee reached out to NBC 7 Responds, saying it's been tough to keep up with patients' needs after the incident forced the medical group to shut down its phone and computer systems around May 5.
The employee NBC 7 spoke to didn’t want to be identified, fearing backlash. But she said some remote workers have been unable to do their jobs due to the systems being down, and their hours are being cut, forcing them to file for unemployment. There has also been a change in leadership. An email to employees in early June announced the CEO and the medical group “mutually decided to part ways.”
Another email, sent that same day, alerted employees that they would be transitioning to a new health insurance plan starting July 1.
PHMG did not answer any of NBC 7's questions about these changes.
