NOTICE OF DATA SECURITY EVENT

Ethan Health, LLC (“Ethan Health”) is providing notice of an incident that may affect the privacy of certain health information. Ethan Health is an outpatient clinic for drug and alcohol rehabilitation located in Richmond, Kentucky and Burlington, Kentucky. Ethan Health is providing details of the incident, its response, and steps individuals may take to better protect their personal information, should they feel it appropriate to do so.

What Happened? 

On August 31, 2022, Ethan Health detected suspicious activity related to certain employees’ email accounts. Upon learning of this activity, Ethan Health took prompt steps to confirm the security of the email accounts and launched an investigation to determine the nature and scope of the incident. The investigation determined that certain email accounts used by the employee were accessible to an unauthorized individual between May 5, 2022, and September 8, 2022. While the investigation was able to determine the email accounts were accessed, it was unable to determine whether any specific email or attachment within the accounts were actually accessed by an unknown actor. Because the possibility of access to this information existed, Ethan Health conducted a detailed review of the contents of the impacted email accounts. By March 9, 2023, Ethan Health identified certain individuals’ information may have been accessed.

What Information Was Involved?

While the specific data elements vary for each potentially affected individual, the scope of information potentially involved includes a individuals’ name, date of birth, driver’s license number, financial account information, credit or debit card information, medical information, and health insurance information..

What We Are Doing?

Ethan Health takes this incident and the security of information within our care very seriously. Upon discovery of this incident, we immediately launched an in-depth investigation to determine the full nature and scope of this incident and moved quickly to assess the security of our email accounts and notify potentially affected individuals. As part of our ongoing commitment to the privacy of information within our care, we are working to implement additional security measures to further protect against similar incidents in the future. We will also be notifying state regulators, as required.

As an added precaution, we are offering impacted individuals 24 months of complimentary access to credit monitoring services through Experian.

What You Can Do?

We encourage individuals to remain vigilant against incidents of identity theft and fraud and to review account statements and credit reports for suspicious activity and to detect errors.

Under U.S. law, a consumer is entitled to one free credit report annually from each of the three major credit reporting bureaus, Equifax, Experian, and TransUnion. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also directly contact the three major credit reporting bureaus listed below to request a free copy of your credit report.

Consumers have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any one of the three major credit reporting bureaus listed below.

As an alternative to a fraud alert, consumers have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without the consumer’s express authorization. The credit freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a credit freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a credit freeze on your credit report. To request a security freeze, you will need to provide the following information:

1. Full name (including middle initial as well as Jr., Sr., II, III, etc.);

2. Social Security number;

3. Date of birth;

4. Addresses for the prior two to five years;

5. Proof of current address, such as a current utility bill or telephone bill;

6. A legible photocopy of a government-issued identification card (state driver’s license or ID card, etc.); and

7. A copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft if you are a victim of identity theft.

Should you wish to place a credit freeze, please contact the three major credit reporting bureaus listed below: