8,362 Patients Potentially Impacted by Advanced Spine & Pain Center Breach
The San Antonio, TX, Advanced Spine & Pain Center (ASPC) has notified patients of a potential breach and unauthorized use of their protected health information. Potentially, as many as 8,362 patients have been affected by the incident.
ASPC became aware of a potential breach of ePHI on July 31, 2017 when some patients reported receiving a telephone call claiming payment for an outstanding bill was required. An investigation was launched to determine whether ASPC systems had been breached.
That investigation revealed unauthorized individuals had gained access to an ASPC server. Unauthorized access occurred even though extensive protections had been put in place, including firewalls, network filtering, security monitoring, password protection, and antivirus software.
While unauthorized access was confirmed, it was unclear whether any sensitive information was accessed by those individuals. It was also not possible to determine whether the telephone calls received by some patients were linked to the security breach.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Since it is possible that patients’ ePHI was viewed or obtained by unauthorized individuals, ASPC has offered all affected patients identity theft protection services and coverage with a $1,000,000 insurance reimbursement policy. A full network scan has been conducted and steps have been taken to ensure the network is secured. Recent monitoring of the network has not uncovered any evidence of continued unauthorized access, and the breach is believed to have been contained.
An analysis of the compromised server has shown the following PHI may have been viewed: Names, addresses, telephone numbers, state and zip codes, Social Security numbers, birth dates, medical records, x-ray images and lab test results, scheduling notes, billing information, insurance information, CPT codes, ID numbers, group numbers, and patients’ gender. No payment information or credit/debit cards were compromised.
The incident has been reported to law enforcement and the Department of Health and Human Services’ Office for Civil Rights has been notified.
