HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

21st Century Oncology Advises 2.2M Patients of Hacking Incident

In October, a hacker gained access to a patient database at 21st Century Oncology containing insurance data and Social Security numbers of patients. The incident is not of the order of the breaches at Anthem, Excellus BCBS, or Primera Blue Cross, but it does rank as one of the largest healthcare data breaches of 2015. On March 4, 2016, a regulatory filing was issued to the United States Securities and Exchange Commission indicating 2.2 million current and former patients were affected and potentially had their data copied and stolen.

21st Century Oncology, which operates 145 cancer treatment centers in the United States, was alerted to the hacking incident on November 13, 2015., by the Federal Bureau of Investigation. An internal investigation into the data breach was immediately launched by 21st Century Oncology; however, the FBI requested that patient notification letters be delayed so as not to interfere with its investigation. The investigation is ongoing, although the requested period of delay has now expired. Patients are now being sent notification letters to advise them of the breach of their data.

The forensic investigation revealed that the attacker may have accessed the patient database, although the FBI believed that the individual in question did illegally obtain protected data from a patient database. 21st Century Oncology did not uncover any evidence to suggest that data had actually been stolen.

The compromised data included the names of current and former patients, insurance data, diagnosis and treatment information, Social Security numbers, and the names of treating physicians.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

21st Century Oncology has now implemented enhanced security measures to prevent future incidents from occurring. To protect patients from harm or loss, all individuals potentially affected have been offered a year of credit monitoring services without charge. It is now several months since the intrusion took place, so all affected patients should obtain EoB statements and check for any suspicious entries dating back to October 2015. Any irregularities should be reported to their insurers.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.