Centerstone, a nonprofit health organization that provides mental health, addiction recovery, residential care, therapeutic foster care, counseling, and crisis services across the country, has learned of a data security incident that may have involved personal and protected health information belonging to certain current and former Centerstone clients. Centerstone has sent notification of this incident to potentially impacted individuals and is providing resources to assist them.
On February 14, 2022, Centerstone detected unusual activity involving its email environment. Upon discovering this activity, Centerstone took immediate steps to secure its email environment and launched a thorough investigation to determine the scope of the issue. The investigation determined that an unknown actor gained access to and may have obtained a limited amount of data from an employee email account on January 8, 2022.
As a result, Centerstone undertook a comprehensive review of the full contents of the email account to identify whether any individual information was contained therein. Centerstone’s review concluded on July 12, 2022, at which time Centerstone learned that the email account contained certain personal and protected health information. In response, Centerstone immediately initiated a diligent search to identify current contact information needed to notify potentially impacted individuals.
Centerstone currently has no evidence of the misuse of any information potentially involved in this incident. However, on September 12, 2022, Centerstone notified potentially affected individuals directly via letter. In so doing, Centerstone provided information about the incident and about steps that potentially impacted individuals can take to protect their information.
The following personal and protected health information may have been involved in the incident: name, address, Social Security number, date of birth, client ID, medical diagnosis / treatment information, and/or health insurance and claims information. However, not all data elements were present for every individual.
The privacy and protection of personal and protected health information is a top priority for Centerstone, which deeply regrets any inconvenience or concern this incident may cause. Centerstone is working to implement additional safeguards to help ensure the security of its email environment and to reduce the risk of a similar incident from occurring in the future. Centerstone has also established a toll-free call center to answer questions about the incident. Call center representatives are available Monday through Friday from 8:00 a.m. – 8:00 p.m. Central Time, excluding holidays and can be reached at 1-833-764-0234.
