What should I do if I was affected by this healthcare data breach?

If you were affected, monitor your credit reports and explanation of benefits statements for suspicious activity, take advantage of any free credit monitoring offered, consider freezing your credit, and document any unauthorized use of your health information. You may also be eligible to join a class action lawsuit for compensation.

How do I know if my data was included in this breach?

The breached organization is required by HIPAA to notify affected individuals within 60 days. Check your mail and email for breach notification letters. You can also contact the organization directly to ask if your records were affected. If the breach involved 500+ individuals, it is publicly reported to HHS and listed in their breach portal.

What is the East Tennessee Children's Hospital data breach?

The East Tennessee Children's Hospital data breach was a hacking/it incident incident reported on 2022-04-07 that affected 501 individuals in Tennessee. Data exposed included: While the specific data elements are not detailed in the breach report, network server breaches at pediatric hospitals typically expose: patient names, dates of birth, medical record numbers, Social S

East Tennessee Children's Hospital Data Breach

Name: East Tennessee Children's Hospital Data Breach
Creator: Durjoy Bhattacharjya
Published: 2022-04-07

East Tennessee Children's Hospital Network Server Breach

medium severityReported April 7, 2022HHS OCR VerifiedTennessee

What happened in the East Tennessee Children's Hospital data breach?

The East Tennessee Children's Hospital data breach was reported on April 7, 2022 and affected 501 individuals. The breach type was Hacking/IT Incident involving Network Server. This breach occurred in Tennessee. Under HIPAA, affected patients must be notified within 60 days and may be entitled to credit monitoring services.

Harding Hall

501

Individuals Affected

Hacking/IT Incident

Breach Type

Network Server

Breach Location

Business Associate

Scale:Larger than 3% of healthcare breaches

4 years ago

HIPAA Category:hacking/IT incident

Visibility:local

East Tennessee Children's Hospital Breach Details

East Tennessee Children's Hospital Data Breach Report

Incident Overview

East Tennessee Children's Hospital experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the U.S. Department of Health and Human Services on April 7, 2022, affecting 501 individuals. This incident represents a hacking or IT-related compromise of the hospital's computer systems, resulting in potential exposure of protected health information (PHI) maintained on networked servers. As a pediatric healthcare facility, the hospital serves vulnerable populations, making the security of patient data particularly critical.

Company Response and Investigation

Upon discovery of the unauthorized access to their network server, East Tennessee Children's Hospital initiated a formal investigation to determine the scope and nature of the breach. The hospital's response included forensic analysis of affected systems, notification procedures in compliance with HIPAA Breach Notification Rule requirements, and coordination with relevant authorities. The submission date of April 7, 2022, indicates the hospital met its obligation to report the breach to HHS within 60 days of discovery, as mandated by 45 CFR §164.404. The hospital likely engaged IT security professionals to conduct a comprehensive review of system logs, access controls, and network traffic to identify the breach vector and determine which patient records were accessed or compromised.

Technical Details of the Breach

Network server breaches typically occur through one or more of several common attack vectors. These may include exploitation of unpatched software vulnerabilities, weak authentication credentials, phishing attacks targeting employee credentials, or direct network intrusion attempts. The fact that the breach location is identified as a "Network Server" suggests the attacker gained unauthorized access to centralized data storage systems rather than individual workstations or portable devices. This type of breach often indicates a more sophisticated attack, as network servers typically contain larger volumes of patient data and require navigating multiple security layers. The 501 individuals affected represents a contained breach, suggesting either that the attacker's access was limited in scope, the breach was detected relatively quickly, or the hospital's network segmentation prevented broader system compromise. Network server breaches may involve lateral movement through the hospital's IT infrastructure, where an attacker gains initial access through one system and then attempts to move to other connected systems to access additional data.

Organizational Context

East Tennessee Children's Hospital is a specialized pediatric healthcare facility serving the East Tennessee region. As a children's hospital, the organization provides comprehensive medical services to pediatric patients, including emergency care, surgical services, inpatient hospitalization, and specialized pediatric treatments. The hospital maintains electronic health records (EHRs) and other digital systems containing sensitive information about minor patients and their families. Pediatric healthcare facilities typically maintain particularly sensitive data, including information about children's medical conditions, developmental history, and family circumstances. The hospital's network infrastructure supports clinical operations, patient care coordination, billing and insurance processing, and administrative functions. The breach of network servers suggests that the hospital's central data repositories, which likely include multiple years of patient records, were compromised or at risk of compromise.

Patient Impact and Notification

The breach affected 501 individuals, primarily patients and potentially family members or guardians whose information was stored in the hospital's systems. These individuals received breach notification letters in accordance with HIPAA requirements, informing them of the unauthorized access and the types of information that may have been exposed. The notification process, which must occur without unreasonable delay and no later than 60 days after discovery of the breach, provides affected individuals with information about the breach, the types of data involved, steps the hospital is taking to address the situation, and recommended actions for protecting themselves against potential misuse of their information. For a pediatric facility, notifications may have been sent to parents or legal guardians on behalf of minor patients. The relatively modest number of affected individuals (501) suggests the breach may have been discovered during a routine security audit, detected through intrusion detection systems, or reported by a security researcher, allowing the hospital to contain the incident before widespread data exfiltration occurred.

HIPAA Compliance and Industry Context

Under the HIPAA Security Rule (45 CFR §§164.308-164.318), covered entities like hospitals must implement administrative, physical, and technical safeguards to protect electronic PHI (ePHI). Network server breaches represent failures in technical safeguards, which should include access controls, encryption, audit controls, and integrity controls. The HIPAA Breach Notification Rule requires covered entities to notify affected individuals, the media (if more than 500 residents of a state are affected), and HHS of breaches of unsecured PHI. Network server compromises are among the most common breach types in healthcare, accounting for a significant percentage of reported breaches annually. According to HHS breach reports, hacking and IT incidents represent one of the leading causes of healthcare data breaches, often resulting from inadequate access controls, unpatched systems, or insufficient network monitoring. The fact that no business associate was involved in this breach indicates the hospital's own systems and staff were responsible for the breach response and remediation. Healthcare organizations have increasingly implemented zero-trust security models, multi-factor authentication, network segmentation, and continuous monitoring to prevent server-based breaches of this nature.

What Data Was Exposed

While the specific data elements are not detailed in the breach report, network server breaches at pediatric hospitals typically expose: patient names, dates of birth, medical record numbers, Social Security numbers, insurance information, diagnoses and medical conditions, treatment history, medication records, laboratory and imaging results, healthcare provider names and contact information, billing and payment information, and potentially emergency contact information for parents or guardians. The exposure of this information on a network server suggests centralized access to comprehensive patient records rather than isolated data elements.

Risks to Patients

Affected individuals face several significant risks from this breach. Identity theft is a primary concern, as Social Security numbers and dates of birth may have been exposed, allowing criminals to open fraudulent accounts or obtain credit in victims' names. Medical identity theft poses particular risks, where unauthorized individuals could use stolen medical information to obtain healthcare services, prescriptions, or medical devices fraudulently. Children's information is particularly valuable to criminals due to the extended period before the fraud may be discovered. Phishing and social engineering attacks may target affected individuals using information obtained from the breach. Unauthorized access to medical records could compromise patient privacy and enable discrimination based on medical conditions. Financial fraud risks include unauthorized use of insurance information or billing account details. The exposure of pediatric patient information creates long-term risks, as children's data may be exploited for years before detection.

What to Do If You Were Affected by the East Tennessee Children's Hospital Breach

Monitor credit reports from all three major credit bureaus (Equifax, Experian, TransUnion) for unauthorized accounts or inquiries; consider placing a fraud alert or credit freeze to prevent unauthorized credit applications
Review medical records and explanation of benefits statements for unauthorized services, treatments, or claims; contact healthcare providers and insurance companies immediately if suspicious activity is detected
Monitor financial accounts, bank statements, and credit card statements for unauthorized transactions; set up account alerts with financial institutions to detect suspicious activity
Consider enrolling in identity theft protection or credit monitoring services if offered by the hospital; maintain copies of breach notification letters and documentation of any fraudulent activity for potential claims or disputes

Monitor Your Medical Records

Request copies to check for unauthorized changes

Check More Tennessee Breaches

Search all breaches reported in Tennessee

Technical Notes

Network server breaches represent unauthorized access to centralized data storage systems, typically indicating compromise of systems containing large volumes of patient records. Common attack vectors for network server breaches include: exploitation of unpatched software vulnerabilities (CVEs), weak or default credentials, phishing attacks targeting administrative or service accounts, SQL injection or other application-layer attacks, and direct network intrusion attempts. The breach location designation suggests the attacker bypassed perimeter security and gained access to internal network resources. The 501-individual impact suggests either rapid detection and containment, network segmentation that limited lateral movement, or restricted attacker access permissions. Network server breaches often involve forensic investigation of system logs, firewall records, and access control lists to determine breach timeline, affected data, and attacker methods. Remediation typically includes patching vulnerabilities, resetting compromised credentials, implementing enhanced monitoring, reviewing access controls, and potentially upgrading encryption or authentication mechanisms. The absence of a business associate indicates the breach occurred within the hospital's own IT infrastructure rather than through a third-party vendor or service provider.

Frequently Asked Questions

How many people were affected by the East Tennessee Children's Hospital data breach?

The East Tennessee Children's Hospital data breach affected 501 individuals. It was reported to the HHS Office for Civil Rights on April 7, 2022 and classified as a hacking/it incident incident in Tennessee.

When was the East Tennessee Children's Hospital breach reported?

The East Tennessee Children's Hospital breach was reported to the U.S. Department of Health and Human Services Office for Civil Rights on April 7, 2022. Under HIPAA, covered entities must report breaches affecting 500 or more individuals within 60 days of discovery.

What type of breach occurred at East Tennessee Children's Hospital?

The East Tennessee Children's Hospital breach was classified as a "Hacking/IT Incident" incident involving "Network Server." This breach is rated medium severity based on the number of individuals affected and the type of data involved.

What data was exposed in the East Tennessee Children's Hospital breach?

What should I do if I was affected by the East Tennessee Children's Hospital data breach?

1. Monitor credit reports from all three major credit bureaus (Equifax, Experian, TransUnion) for unauthorized accounts or inquiries; consider placing a fraud alert or credit freeze to prevent unauthorized credit applications 2. Review medical records and explanation of benefits statements for unauthorized services, treatments, or claims; contact healthcare providers and insurance companies immediately if suspicious activity is detected 3. Monitor financial accounts, bank statements, and credit card statements for unauthorized transactions; set up account alerts with financial institutions to detect suspicious activity 4. Consider enrolling in identity theft protection or credit monitoring services if offered by the hospital; maintain copies of breach notification letters and documentation of any fraudulent activity for potential claims or disputes

What are the risks to patients from the East Tennessee Children's Hospital breach?

How do I file a HIPAA complaint about the East Tennessee Children's Hospital breach?

You can file a HIPAA complaint with the HHS Office for Civil Rights (OCR) online at ocrportal.hhs.gov within 180 days of discovering the violation. The complaint must identify the covered entity (East Tennessee Children's Hospital) and describe the acts or omissions you believe violated HIPAA. You can also contact OCR's toll-free hotline at 1-800-368-1019.

How can I check if I was affected by a healthcare data breach?

You can search for healthcare data breaches by provider name, state, or breach type using MedicalRecords.com's free Breach Check tool at medicalrecords.com/breach-check. The tool searches 1,638 breaches reported to the HHS Office for Civil Rights. Covered entities are also required to notify affected individuals directly.