40K Podiatry Patients Warned of PHI Exposure
Stamford Podiatry Group P.C., has discovered an unauthorized third party gained access to its computer systems for a period of almost two months earlier this year. The intruder was able to view company data and potentially also accessed the electronic medical record database (EMR). 40,491 patients have now been notified of the privacy breach and potential accessing/theft of their protected health information.
EMR data potentially accessed/copied include names, addresses, dates of birth, email addresses, telephone numbers, Social Security numbers, health insurance information, names of treating and referring physicians, and patients’ gender and marital status. Diagnoses, details of treatments, and medical histories were also stored in the EMR and may have been accessed.
An investigation into the breach revealed that access was first gained to the company’s systems on February 22, 2016 and continued until the data breach was discovered on April 14, 2016. While the investigation determined that data access was possible, no evidence was uncovered to suggest that data were actually viewed or copied; however, the possibility could not be ruled out. To date, Stamford Podiatry Group has not received any reports of patients’ PHI being used inappropriately.
Due to the sensitive nature of the exposed data patients face an elevated risk of identity theft and fraud. To reduce the risk of harm or losses being suffered, Stamford Podiatry Group has offered all affected patients complimentary credit monitoring services and identity theft insurance. Patients have been advised to obtain and review their Explanation of Benefits statements and to monitor their accounts carefully for any sign of fraudulent activity.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
External computer forensics experts were hired to assist with the investigation and have been retained to provide continued cybersecurity assistance to the company. A range of additional security measures have also been implemented to strengthen protections and prevent future cyberattacks from occurring.
