HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

ATI Physical Therapy Data Breach Impacts 35,000 Patients

ATI Physical Therapy has discovered the protected health information of more than 35,000 patients has potentially been compromised when threat actors gained access to the email accounts of some of its employees.

A security breach was identified on January 18, 2018 when ATI Physical Therapy discovered the direct deposit information of some of its employees had been changed in its payroll platform. Prompt action was taken to protect its employees and external forensic investigators were called in to determine the full extent and scope of the breach.

The investigation revealed the email accounts of certain employees had been compromised and were accessed by unauthorized individuals between January 9 and January 12, 2018. An analysis of the emails in the accounts revealed they contained the protected health information of tens of thousands of patients.

The types of information potentially compromised varied per impacted individual, but may have included names, dates of birth, credit/debit card numbers, driver’s license numbers, state ID numbers, Social Security numbers, Medicare/Medicaid information, health insurance information, billing/claims information, medical record numbers, patient ID numbers, financial account numbers, disability codes, diagnoses, treatment information, prescription information, and physicians’ and therapists’ names.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

ATI Physical Therapy reports that only a small number of patients had their Social Security numbers exposed.

Patients impacted by the phishing incident have now been notified by mail and have been offered credit monitoring services without charge. Patients will also be protected by a $1 million identity theft insurance policy. No evidence of misuse of information has been uncovered by ATI Physical Therapy of the forensic investigators.

ATI Physical Therapy’s investigation into the breach is ongoing and steps have been taken to strengthen email security to prevent future breaches and employees have been provided with training to help them identify phishing emails.

The Department of Health and Human Services’ Office for Civil Rights breach report indicates 35,136 patients have potentially have their protected health information accessed.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.