January 21, 2020
Sunshine Behavioral Health Group, LLC (“Sunshine”) recently experienced a privacy incident that affected the protected health information of some Mountain Springs Recovery patients and personal information of individuals who provided payment information for Mountain Springs Recovery patients (collectively, “personal information”). Sunshine provides business services to several health care providers, including Mountain Springs Recovery. Sunshine is not aware of any malicious misuse of this personal information, but has provided the following information to Mountain Springs Recovery out of an abundance of caution so potentially affected individuals can take steps to help safeguard their personal information, if they feel it is appropriate to do so.
On September 4, 2019, Sunshine became aware that a cloud-based system used to store certain Mountain Springs Recovery patient records was inadvertently set-up in such a manner that permitted the records to be made available on the Internet. Sunshine immediately took steps to change the settings, and, on November 14, 2019, took additional actions to remove the records from general Internet access. Through an ensuing investigation, on December 23, 2019, Sunshine determined that the incident potentially affected the personal information of some Mountain Springs Recovery patients and individuals who provided payment information for Mountain Springs Recovery patients. Such personal information varies by impacted individual, and may include the following: first and last name and other demographic and contact information; financial account information; clinical and medical information; health insurance, claims and account balance information; and electronic or digital signature. A small subset of individuals also had their Social Security numbers impacted by the incident.
To get further information, including whether you were affected by the incident and what personal information may have been impacted by the incident, you may call Sunshine’s dedicated assistance line at (833) 719-0129 (toll free), Monday through -Friday, 9:00 a.m. to 9:00 p.m., EST. If Sunshine has confirmed that your personal information was affected by the incident, Sunshine is offering MyIDCare protection through ID Experts for 24 months at no cost.
We recommend that you remain vigilant by reviewing account statements and monitoring free credit reports. You may also report suspected incidents of identity theft to local law enforcement or your state attorney general.
If you would like information about placing fraud alerts or credit freezes, you can contact one of the three major credit bureaus:
There is no cost to freeze or unfreeze your credit files. In order to request a security freeze, you will need to provide the following information:
- Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
- Social Security number;
- Date of birth;
- If you have moved in the past five (5) years, provide the addresses where you have lived over the prior five years;
- Proof of current address, such as a current utility bill or telephone bill;
- A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.);
- If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning the identity theft.
You can also obtain additional information about the steps you can take to avoid identity theft from the following agencies:
- All US Residents: Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, D.C. 20580, www.consumer.gov/idtheft, 1-877-IDTHEFT (438-4338), TTY: 1-866-653-4261.
- California Residents: Visit the California Office of Privacy Protection (www.oag.ca.gov/privacy) for additional information on protection against identity theft.
- Kentucky Residents: Office of the Attorney General of Kentucky, 700 Capitol Avenue, Suite 118, Frankfort, KY 40601, www.ag.ky.gov,Telephone: 1-502-696-5300.
- Maryland Residents: Office of the Attorney General of Maryland, Consumer Protection Division, 200 St. Paul Place, Baltimore, MD 21202, www.oag.state.md.us/Consumer, Telephone: 1-888-743-0023.
- New Mexico Residents: You have rights pursuant to the Fair Credit Reporting Act, such as the right to be told if information in your credit file has been used against you, the right to know what is in your credit file, the right to ask for your credit score, and the right to dispute incomplete or inaccurate information. Further, pursuant to the Fair Credit Reporting Act, the consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information; consumer reporting agencies may not report outdated negative information; access to your file is limited; you must give your consent for credit reports to be provided to employers; you may limit “prescreened” offers of credit and insurance you get based on information in your credit report; and you may seek damages from a violator. You may have additional rights under the Fair Credit Reporting Act not summarized here. Identity theft victims and active duty military personnel have specific additional rights pursuant to the Fair Credit Reporting Act. You can review your rights pursuant to the Fair Credit Reporting Act by visiting www.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf, or by writing to the Consumer Response Center, Room 130-A, Federal Trade Commission, 600 Pennsylvania Ave. N.W., Washington, D.C. 20580.
- North Carolina Residents: Office of the Attorney General of North Carolina, 9001 Mail Service Center, Raleigh, NC 27699-9001, www.ncdoj.gov, Telephone: 1-919-716-6400.
- Oregon Residents: Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096, www.doj.state.or.us/, Telephone: 877-877-9392.
- Rhode Island Residents: Office of the Attorney General, 150 South Main Street, Providence, RI 02903, www.riag.ri.gov, Telephone: 401-274-4400.