Telehealth platform ConnectOnCall breached, exposing data of 910k individuals
Learn More
Phreesia, a healthcare SaaS company, has disclosed a significant data breach affecting its subsidiary ConnectOnCall, a telehealth platform providing after-hours answering services and patient call tracking.
The breach was discovered on May 12, 2024. The company notified federal law enforcement, engaged external cybersecurity specialists, and took ConnectOnCall's systems offline. They are currently working to restore services within a new, more secure environment. Phreesia has emphasized that the breach was isolated to ConnectOnCall and did not affect their other services, including their patient intake platform.
The incident exposed the personal and health information of 914,138 patients over a nearly three-month period, from February 16 to May 12, 2024.Te compromised information includes:
- Names
- Phone numbers
- Medical record numbers
- Dates of birth
- Health conditions
- Treatment information
- Prescription details
- Social Security numbers (in a limited number of cases)
The nature of the attack is not disclosed, and the length of unauthorized acces (3 months) raises concerns about the security capabilities of the company.
Phreesia claims there is no evidence of misuse of the exposed information, but they are advising affected individuals to report any suspected identity theft or fraud to their insurers, health plans, or financial institutions.
