Children’s Minnesota is committed to protecting the security and privacy of our patients. Regrettably, we recently learned of an incident that occurred at one of our vendors, Blackbaud, Inc. (“Blackbaud”), that may have involved some Children’s Minnesota data.
What happened?
Blackbaud is a vendor that provides the Children’s Minnesota Foundation (the “Foundation”) with cloud-based and data solution services related to fundraising activities. On July 16, 2020, Blackbaud informed us it had discovered that an unauthorized individual had gained access to Blackbaud’s systems between February 7 and May 20, 2020. Blackbaud advised us that the unauthorized individual may have acquired backup copies of databases used by its customers, including a backup of a database the Foundation uses for fundraising efforts. We immediately took steps to understand the extent of the incident and the data involved.
What information was involved?
Based on our investigation and review of the affected Blackbaud database, the incident involved limited patient information that the Foundation received in connection with its fundraising efforts, including: full names, addresses, phone numbers, age, dates of birth, gender, medical record numbers, dates of treatment, locations of treatment, names of treating clinicians and health insurance status.
Importantly, financial account, credit card information and Social Security numbers were not contained in the affected Blackbaud database. This incident did not involve any access to our medical systems or electronic health records.
How are we responding?
We want our patients to know that we are taking this matter very seriously. While Blackbaud has informed us that it has no reason to believe any data was or will be misused, disseminated or otherwise made publicly available, we recommend affected individuals review any statements received from their healthcare providers. If individuals see services they did not receive, please contact the provider immediately. We have also established a dedicated call center, which may be contacted at (866) 968-0207 from 8:00 a.m. to 5:30 p.m. Central Time, Monday through Friday, excluding major U.S. holidays. To help prevent something like this from happening again, we are evaluating our arrangement with Blackbaud and its security safeguards.
We regret any concern or inconvenience this incident may cause. As a nonprofit pediatric health care system, Children’s Minnesota relies on philanthropy to ensure the highest quality, patient-centric care to kids in our community, and we will continue our commitment to protecting the security and privacy of patient information.