Notice of Data Privacy Incident

Date: 04/18/2019

Northern Light Acadia Hospital recently discovered an incident that could affect the privacy of certain individuals who received care from Northern Light Acadia Hospital.  We take this incident very seriously, and we wanted to share information about the incident and our response.
What happened?  On April 10, 2019, a Northern Light employee emailed a Bangor Daily News (“BDN”) reporter in response to a request for unrelated information from the reporter.  This employee mistakenly sent an email with an attached file that contained information related to certain Northern Light Acadia Hospital patients. On April 11, 2019, we discovered that the file was inadvertently sent when the recipient recognized the sensitive nature of the file and immediately contacted the employee regarding the inadvertent disclosure. Both the recipient and BDN have cooperated fully in the response to this incident. The reporter who received the file attachment confirmed that the patient information was not shared with anyone else and the file was permanently deleted and destroyed.
What information was affected by this incident?  The inadvertently disclosed file contained patient names, medical record numbers, medication type, provider names, and dates of treatment.  The file did not contain patients’ Social Security numbers, diagnoses, or health insurance or other payment information.
How will individuals know if they are affected by this incident?   Northern Light Acadia Hospital is mailing notice letters to the individuals whose information was contained within the inadvertently disclosed file. If an individual did not receive a letter but would like to know if they are affected, they may call the number listed below.
What is Northern Light doing?  Information privacy and security are among our highest priorities. Northern Light Acadia Hospital has strict security measures to protect the information in our possession. Upon learning of this incident, we began conducting a thorough review of our information sharing protocols. Further, we are implementing additional technical safeguards to prevent similar future incidents. Northern Light Acadia will be providing notice of this incident to the U.S. Department of Health and Human Services.
While the recipient of the file and the BDN have provided assurances that the file was permanently deleted and destroyed and that the information at issue was not shared with any other parties and will not be misused, we encourage individuals affected by this incident to review their account statements, health insurance account records, and explanation of benefits forms for suspicious activity, and report all suspicious activity to the institution that issued the record immediately.
Whom should individuals contact for more information? If individuals have additional questions or would like additional information, they may call our dedicated assistance line at (207) 973-6048 at any time. They may also write to Northern Light Acadia Hospital, attention Lisa Hussey - Director of Service Excellence, Northern Light Acadia Hospital, P.O. Box 422, Bangor, ME 04402-0422.
We sincerely apologize that this incident occurred, and we regret any hardship this incident may cause. Northern Light Acadia Hospital remains committed to safeguarding the information in our care and we will continue to take steps to ensure the security of our systems.