Nuance notifying radiology patients after data security incident

Nuance uncovered a data security incident at Indiana University Health that may have impacted some of the Midwest health systems radiology patients, according to an announcement shared Friday.

The incident involved Nuance’s use of MOVEit Transfer software for exchanging files. Unauthorized parties were able to access files on the application between May 28 and 29, with impacted information including the name, date, and reason/description of the exams for patients who received radiology services at IU Health.

Nuance emphasized that the incident did not impact any systems or applications beyond MOVEit, including the radiology vendor’s imaging solutions.

“To help prevent similar incidents from happening in the future, Nuance implemented and is continuing to implement new security tools, processes, and procedure to further strengthen the security of its IT system environments,” IU Health said in an announcement.

Nuance began notifying impacted patients about the incident on Sept. 22. The Burlington, Massachusetts-based vendor, which is part of Microsoft, also is implementing new security tools, processes and procedures to further strengthen the security of its IT systems, IU Health noted.

In its own separate announcement, Nuance said that Progress Software recently experienced a data security issue in its MOVEit file transfer software. Nuance uses the product to exchange files with some customers and business partners and was “unfortunately, one of the thousands of organizations impacted by Progress Software’s vulnerability.”

“Data privacy and security are among Nuance’s highest priorities. The company has extensive measures in place to protect information entrusted to us,” Nuance said in its announcement.