Report of Third-Party Data Breach Affecting EHP Members

To EHP members at the Johns Hopkins University School of Medicine, The Johns Hopkins Hospital, Johns Hopkins Health System Corporation, Johns Hopkins Bayview Medical Center, Johns Hopkins Community Physicians, Johns Hopkins Health Care, Johns Hopkins Home Care Group, Howard County General Hospital, Sibley Memorial Hospital and Suburban Hospital

Dear Colleagues,

I'm writing to alert you about a data breach you might have heard of that affects Johns Hopkins employees and their dependents who are members of our EHP health insurance plan.

The breach did not occur on Johns Hopkins' servers. Unauthorized access took place on the server of a third-party subcontractor, Newkirk Products, which produces member ID cards for health plans across the country, including EHP. Although the incident took place in May and was not discovered until early July, we were not made aware of it until just recently. An investigation is underway, and to date, there is no evidence that any information has been used.

Please know that:

• We have been assured that the breach relates only to information that would have been printed on the plastic member ID cards and mailing envelope, such as name, address, health insurance individual plan and group numbers, and primary care physician.
• Because the cards do not include a Social Security number, date of birth, medical information, banking or credit card information, that important data was not compromised.
• The vendor does not have access to any medical information.

We are working with Newkirk Products to see that plan members who may be affected by this breach are notified as quickly as possible. Newkirk will issue a correspondence that will include information about free identity theft monitoring services available to provide identity protection and peace of mind for individuals who may have been affected. We are also working to ensure that additional security steps are addressed to ensure that members' information is safe.

We are taking this information seriously and regret any inconvenience or worry that this may cause you. If there is more information to share on any findings and next steps, you will receive an update.

In the meantime, our service team is available to take calls from EHP members at 844-422-6957.

Sincerely,

Patricia M.C. Brown, Esq.  
SVP, Managed Care and Population Health, Johns Hopkins Medicine
President, Johns Hopkins HealthCare LLC