Surgical Dermatology Group Informs Patients of Cloud Services Provider Breach
Hackers have gained access to a server maintained by cloud hosting and server management provider TekLinks and have potentially accessed/copied the protected health information of patients of Surgical Dermatology Group in Birmingham, AL.
The intrusion was discovered on or around May 1, 2017, although the breach investigation revealed access to the server was first gained on March 23, 2017. TekLinks said access to the server was blocked on May 1, and its monitoring systems showed no access took place between April 22 and May 1, although it is possible data were viewed or copied in the previous four weeks.
Surgical Dermatology Group has been working with forensic investigators to determine the nature and scope of the breach and reports that a wide range of protected health information was potentially accessed. The types of data stored on the compromised server includes patients’ names, home and work telephone numbers, cell phone numbers, addresses, email addresses, medical record numbers, patient ID numbers, Social Security numbers, health plan numbers, details of charges and payments and physicians’ names. Financial information and credit/debit card numbers were not compromised as they were not stored on the server.
Surgical Dermatology Group has not received any reports to suggest any information on the server has been accessed or misused in any way, although due to the sensitive nature of data involved, all affected individuals have been offered credit monitoring and identity theft protection services for 12 months without charge.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
All affected patients have now been notified of the breach and the incident has been reported to appropriate authorities, including the Federal Bureau of Investigation.
The forensic investigation team has confirmed that all servers are now secured and access is no longer possible. Steps have also been taken to improve security to prevent further breaches. A spokesperson for the company said, “Surgical Dermatology Group takes very seriously its responsibility to protect your information and deeply regrets this unfortunate incident.”
The incident has now been reported to the Department of Health and Human Services’ Office for Civil Rights. The breach report indicates 14,000 individuals have been impacted.
