CPM Investigating ConnectOnCall Data Breach

CPM is investigating a data breach at ConnectOnCall, a subsidiary of Phreesia that affected more than 900,000 people. The company revealed that “On May 12, 2024, ConnectOnCall learned of an issue impacting ConnectOnCall and immediately began an investigation and took steps to secure the product and ensure the overall security of its environment. … ConnectOnCall’s investigation revealed that between February 16, 2024, and May 12, 2024, an unknown third party had access to ConnectOnCall and certain data within the application, including certain information in provider-patient communications.” Importantly, ConnectOnCalll waited over six months before notifying its customers that their data was stolen, giving hackers and identity thieves a tremendous opportunity to sell and utilize this private information before customers could take any steps to protect their information and identity. The data that was compromised includes, information shared in communications between patients and their healthcare providers, such as names and phone numbers, medical record numbers, dates of birth, as well as information related to health conditions, treatments, or prescriptions, and, in a small number of cases, social security numbers.

If your identity theft monitoring service has notified you that your information was included in the breach, or you have a received a notification from Phreesia or ConnectOnCall, you may be entitled to compensation.

Companies like ConnectOnCall that handle consumers’ most sensitive information must do more to protect the valuable information entrusted to them. Consumers deserve to have their information protected and when mega corporations like Phreesia/ConnectOnCall fall short of their obligations, consumers are entitled to compensation. Cotchett, Pitre & McCarthy Partner, Thomas E. Loeser, is a former federal cyber-prosecutor specializing in hacking and data breach cases. If you received notice of the ConnectOnCall breach, please fill out the form below to make sure your rights are protected, and ConnectOnCall is held to account for its failure to protect your information.