Cyber-attack results in theft of 4.5 million patients personal information

The information stolen from Community Health included patient names, addresses, birth dates, telephone numbers and Social Security numbers of people who were referred or received services from doctors affiliated with the hospital group in the last five years, the company said in a regulatory filing.

The stolen data did not include medical or clinical information, credit card numbers, or any intellectual property such as data on medical device development, said Community Health, which has 206 hospitals in 29 states.

This attack was not the first time that China-based hackers have stolen information from US companies. Also, the adoption of electronic medical records by hospitals and doctors’ offices is not mandatory under provisions of the Affordable Care Act, but the law essentially punishes those who do not computerize their patient data by withholding, or diverting, Medicare and Medicaid payments.