CaptureRx, Former Vendor of Altru, Shares of Data Incident

Grand Forks, N.D. - A former third-party vendor for Altru Health System, CaptureRX, has provided notice that an incident involving data received from healthcare providers, including Altru, occurred in February of 2021.

On or around February 19, 2021, CaptureRX became aware of unusual activity involving certain electronic files. CaptureRx immediately launched an investigation into this activity and determined that certain files were accessed and acquired on February 6, 2021 without authorization. On or around March 19, 2021, CaptureRx completed a full review of the files and determined that the impacted individuals included individuals receiving drugs prescribed through Altru’s 340B pharmacy program through CVS and Thrifty White Drug. CaptureRx’s investigation determined that the affected files contained first name, last name, date of birth and prescription information. No financial information was affected or compromised.

After learning of this incident, CaptureRx moved quickly to investigate and respond. This investigation and response included confirming the security of CaptureRx’s systems, reviewing the contents of the relevant files for sensitive information, and notifying covered entities associated with that sensitive information. As part of CaptureRx’s ongoing commitment to the security of information, all policies and procedures are being reviewed and enhanced and additional workforce training is being conducted to reduce the likelihood of a similar future event.

Upon notification of this data incident by Capture Rx in May 2021, Altru has supported CaptureRx’s investigation and the notification to all individuals whose information was contained in the files as well as the appropriate regulatory authorities. Individuals whose information was impacted will receive notification via mail. CaptureRx has established a dedicated assistance line at (855) 654.0919 (toll free), Monday-Friday, 8 a.m. - 8 p.m. CST for any questions from affected individuals.

Data privacy is of the utmost importance to Altru Health System. Altru abides by the privacy and security standards that protect Patient Health Information (“PHI”) as set forth in the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Health Information Technology for Economic and Clinical Health Act (“HITECH”), and other federal and state statutes, regulations. Altru also ensures secure and encrypted transfer of all PHI to Business Associates. Altru will complete its own investigation of this incident. Altru will continue to prioritize the privacy and security of all PHI and to apply the same standards to its vendors who have access to individually identifiable information.

While there was no financial information compromised, Altru and CaptureRx encourage individuals to remain vigilant against incidents of identity theft and fraud, to review account statements and explanation of benefits forms, and to monitor free credit reports for suspicious activity and to detect errors.

About Altru Health System

Based in Grand Forks, North Dakota, Altru Health System is a physician-led, multispecialty group practice with an acute care hospital, Level II trauma center, specialty hospital, more than two dozen Grand Forks and regional practice locations, and a large home care network. Altru Health System was the first member of the Mayo Clinic Care Network, extending Mayo Clinic knowledge and expertise to the patients we serve. For more information, visit altru.org.