HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

American Osteopathic Association Notifies 27,500 Individuals About June 2020 Data Theft Incident

Approximately 27,500 individuals are being notified that some of their personal information was stolen in a cyberattack on the American Osteopathic Association (AOA). AOA is a Chicago-based professional organization that represents around 151,000 osteopathic physicians and medical students across the United States.

On June 25, 2020, the AOA identified suspicious activity within some of its systems. Its network was taken offline, and forensic investigators were engaged to determine the nature and scope of the incident. The investigation confirmed the attackers gained access to systems that contained personally identifiable information and exfiltrated data from those systems.

A comprehensive review of the files was conducted to determine which individuals had been affected. That review determined names, addresses, dates of birth, Social Security numbers, financial account information, and email addresses/usernames and passwords were in the exfiltrated data.

The AOA said its investigation did not uncover any evidence of actual or attempted misuse of the stolen data, but as a precaution against identity theft and fraud, affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

It has taken more than 15 months from the discovery of the breach for affected individuals to be notified. The AOA said that like many organizations, the COVID-19 pandemic presented considerable challenges to its normal business operations. As a result of the pandemic, it took considerably longer for AOA to identify the names and addresses of the affected individuals. According to the AOA, this was “due to the pandemic’s impact on our staff’s working conditions, and their inability to be on location to identify all potentially impacted parties.” It took until June 1, 2021, for the total population of affected individuals and contact information to be identified.

According to the breach report submitted to the Maine Attorney General, notifications were sent to affected individuals on October 13, 2021.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.