Retina Group of Washington Data Breach Affects 456,000 Patients
Almost 456,000 individuals have been affected by a Retina Group of Washington data breach and have started receiving notifications, 9 months after the breach occurred.
On December 22, 2023, Retina Group of Washington, PLLC, filed a breach report with the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) that involved the protected health information of 455,935 individuals. Notification letters started to be mailed the same day.
According to the notification letters, Retina Group of Washington started experiencing difficulty accessing information on some of its systems on March 26, 2023. An investigation was launched, and the Federal Bureau of Investigation (FBI) was notified, and it was determined that the file access problems were due to a cyberattack.
Retina Group of Washington did not state the cause of the cyberattack but the wording of the letters suggests this was a ransomware attack. In the notification letters, Retina Group of Washington said the investigation into the cyberattack is still ongoing, but it has been confirmed that patient data was stolen in the attack.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The types of information involved include names, addresses, telephone numbers, email addresses, dates of birth, demographic information, Social Security numbers, Driver’s license numbers, medical record numbers, health information, payment information, and health insurance information.
Retina Group of Washington said it has not identified any attempted or actual misuse of patient data and will continue to implement additional procedures and security measures to strengthen the security of its systems.
Based on the breach notifications, it does not appear that credit monitoring and identity theft protection services are being offered. Affected patients have been told to “remain vigilant against incidents of identity theft and fraud, to review their account and explanation of benefits statements, and to monitor their free credit reports for suspicious activity and to detect errors.” Retina Group of Washington also suggests placing a credit freeze on accounts.
Update April 2025: Several class action lawsuits were filed in response to the data breach. A $3.6 million settlement has been agreed to bring the litigation to an end.
