21st Century Oncology Advises 2.2M Patients of Hacking Incident
In October, a hacker gained access to a patient database at 21st Century Oncology containing insurance data and Social Security numbers of patients. The incident is not of the order of the breaches at Anthem, Excellus BCBS, or Primera Blue Cross, but it does rank as one of the largest healthcare data breaches of 2015. On March 4, 2016, a regulatory filing was issued to the United States Securities and Exchange Commission indicating 2.2 million current and former patients were affected and potentially had their data copied and stolen.
21st Century Oncology, which operates 145 cancer treatment centers in the United States, was alerted to the hacking incident on November 13, 2015., by the Federal Bureau of Investigation. An internal investigation into the data breach was immediately launched by 21st Century Oncology; however, the FBI requested that patient notification letters be delayed so as not to interfere with its investigation. The investigation is ongoing, although the requested period of delay has now expired. Patients are now being sent notification letters to advise them of the breach of their data.
The forensic investigation revealed that the attacker may have accessed the patient database, although the FBI believed that the individual in question did illegally obtain protected data from a patient database. 21st Century Oncology did not uncover any evidence to suggest that data had actually been stolen.
The compromised data included the names of current and former patients, insurance data, diagnosis and treatment information, Social Security numbers, and the names of treating physicians.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
21st Century Oncology has now implemented enhanced security measures to prevent future incidents from occurring. To protect patients from harm or loss, all individuals potentially affected have been offered a year of credit monitoring services without charge. It is now several months since the intrusion took place, so all affected patients should obtain EoB statements and check for any suspicious entries dating back to October 2015. Any irregularities should be reported to their insurers.
