HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

40K Podiatry Patients Warned of PHI Exposure

Stamford Podiatry Group P.C., has discovered an unauthorized third party gained access to its computer systems for a period of almost two months earlier this year. The intruder was able to view company data and potentially also accessed the electronic medical record database (EMR). 40,491 patients have now been notified of the privacy breach and potential accessing/theft of their protected health information.

EMR data potentially accessed/copied include names, addresses, dates of birth, email addresses, telephone numbers, Social Security numbers, health insurance information, names of treating and referring physicians, and patients’ gender and marital status. Diagnoses, details of treatments, and medical histories were also stored in the EMR and may have been accessed.

An investigation into the breach revealed that access was first gained to the company’s systems on February 22, 2016 and continued until the data breach was discovered on April 14, 2016. While the investigation determined that data access was possible, no evidence was uncovered to suggest that data were actually viewed or copied; however, the possibility could not be ruled out. To date, Stamford Podiatry Group has not received any reports of patients’ PHI being used inappropriately.

Due to the sensitive nature of the exposed data patients face an elevated risk of identity theft and fraud. To reduce the risk of harm or losses being suffered, Stamford Podiatry Group has offered all affected patients complimentary credit monitoring services and identity theft insurance. Patients have been advised to obtain and review their Explanation of Benefits statements and to monitor their accounts carefully for any sign of fraudulent activity.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

External computer forensics experts were hired to assist with the investigation and have been retained to provide continued cybersecurity assistance to the company. A range of additional security measures have also been implemented to strengthen protections and prevent future cyberattacks from occurring.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.