Notice of Omnigo Software Security Incident Omnigo Software, a vendor that provides software that is used to track visitor management and dispatch requests at Mission Hospital (“Hospital”) experienced a data security incident. This notice explains the incident, the measures we have taken in response and the steps individuals can take to protect their personal information. On July 5, 2022, Omnigo became aware that its visitor logs that describe security incidents at Hospital had been accessible on the Internet due to a server used to transfer data being unsecure and that the logs were downloaded by an unauthorized user. The access happened on five dates between August 3, 2021 and November 5, 2022. Once notified by Omnigo of this incident, we began an investigation to determine what happened and what data was impacted. We completed our analysis on July 20, 2023. The data fields involved included patient names, addresses, dates of birth, phone numbers, email addresses, information indicating or suggesting status as a patient at Hospital, information indicating or suggesting dates of service, location Hospital, driver’s licenses, and information indicating or suggesting the types of services being provided. Not all data fields were involved for each affected individual. The incident did not involve copies of medical records or Social Security Numbers, nor did it include any financial data. Data privacy and security are among Hospital’s highest priorities. To help prevent similar incidents from happening in the future, we have confirmed the visitor log has been properly secured. Omnigo has implemented enhanced security measures, including resetting its controls and no longer transferring data through the server at issue. Individuals should remain vigilant against incidents of identity theft and fraud, review account statements, and monitor their free credit reports for suspicious activity and to detect errors. You may also review the attached Steps You Can Take to Help Protect Your Information as a helpful resource. We are providing notice of Omnigo’s incident to affected individuals. Individuals with questions, including whether their information was impacted, may contact us at (828) 213-8541. Steps You Can Take to Help Protect Your Information Monitor Your Accounts We recommend that you regularly review statements from your accounts and periodically obtain your credit report from one or more of the national credit reporting companies. You may obtain a free copy of your credit report online at www.annualcreditreport.com, by calling toll-free 1-877-322-8228, or by mailing an Annual Credit Report Request Form (available at www.annualcreditreport.com) to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA, 30348-5281. You may also purchase a copy of your credit report by contacting one or more of the three national credit reporting agencies listed below. Equifax® P.O. Box 740241 Atlanta, GA 30374-0241 1-800-685-1111 www.equifax.com Experian P.O. Box 9701 Allen, TX 75013-9701 1-888-397-3742 www.experian.com TransUnion® P.O. Box 1000 Chester, PA 19016-1000 1-800-888-4213 www.transunion.com When you receive your credit reports, review them carefully. Look for accounts or creditor inquiries that you did not initiate or do not recognize. Look for information, such as home address and Social Security number that is not accurate. If you see anything you do not understand, call the credit reporting agency at the telephone number on the report. Credit Freeze You have the right to put a security freeze, also known as a credit freeze, on your credit file, so that no new credit can be opened in your name without the use of a Personal Identification Number (PIN) that is issued to you when you initiate a freeze. A credit freeze is designed to prevent potential credit grantors from accessing your credit report without your consent. If you place a credit freeze, potential creditors and other third parties will not be able to access your credit report unless you temporarily lift the freeze. Therefore, using a credit freeze may delay your ability to obtain credit. Pursuant to federal law, you cannot be charged to place or lift a credit freeze on your credit report. Should you wish to place a credit freeze, please contact all three major consumer reporting agencies listed below. Equifax® P.O. Box 740241 Atlanta, GA 30374-0241 1-800-685-1111 www.equifax.com Experian P.O. Box 9701 Allen, TX 75013-9701 1-888-397-3742 www.experian.com TransUnion® P.O. Box 1000 Chester, PA 19016-1000 1-800-888-4213 www.transunion.com You must separately place a credit freeze on your credit file at each credit reporting agency. The following information should be included when requesting a credit freeze: Full name, with middle initial and any suffixes Social Security number Date of birth (month, day, and year) Current address and previous addresses for the past five (5) years Proof of current address, such as a current utility bill or telephone bill Other personal information as required by the applicable credit reporting agency If you request a credit freeze online or by phone, then the credit reporting agencies have one (1) business day after receiving your request to place a credit freeze on your credit file report. If you request a lift of the credit freeze online or by phone, then the credit reporting agency must lift the freeze within one (1) hour. If you request a credit freeze or lift of a credit freeze by mail, then the credit agency must place or lift the credit freeze no later than three (3) business days after getting your request. Fraud Alerts You also have the right to place an initial or extended fraud alert on your file at no cost. An initial fraud alert lasts 1-year and is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting 7 years. Should you wish to place a fraud alert, please contact any one of the agencies listed below. The agency you contact will then contact the other two credit agencies. Equifax® P.O. Box 740241 Atlanta, GA 30374-0241 1-800-685-1111 www.equifax.com Experian P.O. Box 9701 Allen, TX 75013-9701 1-888-397-3742 www.experian.com TransUnion® P.O. Box 1000 Chester, PA 19016-1000 1-800-888-4213 www.transunion.com Monitor Your Personal Health Information If applicable to your situation, we recommend that you regularly review the explanation of benefits statement that you receive from your insurer. If you see any service that you believe you did not receive, please contact your insurer at the number on the statement. If you do not receive the regular explanation of benefits statements, contact your provider and request them to send such statements following the provision of services in your name or number. You may want to order copies of your credit reports and check for any medical bills that you do not recognize. If you find anything suspicious, call the credit reporting agency at the phone number on the report. Keep a copy of this notice for your records in case of future problems with your medical records. You may also want to request a copy of your medical records from your provider, to serve as a baseline. If you are a California resident, we suggest that you visit the website of the California Office of Privacy Protection at www.privacy.ca.gov to find more information about your medical privacy. Additional Information You can further educate yourself regarding identity theft and the steps you can take to protect yourself, by contacting your state Attorney General or the Federal Trade Commission. Instances of known or suspected identity theft should be reported to law enforcement, your Attorney General, and the FTC. The Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC 20580 1-877-ID-THEFT (1-877-438-4338) TTY: 1-866-653-4261 www.ftc.gov/idtheft North Carolina Attorney General's Office 114 West Edenton Street Raleigh, NC 27603 1-888-397-3742 https://ncdoj.gov/