Californian Healthcare Provider Discovers Patient Data was Exposed on the Internet for Over a Year
Doctors Medical Center of Modesto (DCM) in California has discovered a contractor used by a former vendor accidentally exposed patient data over the Internet.
DCM had contracted with the SaaS platform provider Medifies to provide virtual waiting room services. On April 2, 2021, DCM discovered the data of some of its patients was accessible over the Internet. DCM contacted Medifies about the exposed data and the issue was corrected the same day and the data was secured.
The investigation into the breach confirmed an error had been made when performing a software update which allowed the data to be accessed via the Internet. The error was made by a Medifies software development contractor.
The software update that made the information accessible occurred in December 2019, which meant patient data had been exposed online for more than a year, during which time it is possible that it was found and viewed by unauthorized individuals. No evidence was found to suggest any of the exposed information was viewed by unauthorized individuals.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The exposed data varied from patient to patient and may have included name, address, email address, date of birth, general procedure information, procedure date, and physician name. The names, addresses, email addresses, and cell phone numbers of significant others who may have subscribed to receive updates regarding a patient’s procedure may also have been exposed.
DCM had previously terminated its business relationship with Medifies but has been working closely with the company to investigate the breach. The types of information exposed should not put people at risk of identity theft; however, out of an abundance of caution, affected individuals have been offered complimentary credit monitoring services for one year and have until April 23, 2022 to activate those services.
