HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Californian Healthcare Provider Discovers Patient Data was Exposed on the Internet for Over a Year

Doctors Medical Center of Modesto (DCM) in California has discovered a contractor used by a former vendor accidentally exposed patient data over the Internet.

DCM had contracted with the SaaS platform provider Medifies to provide virtual waiting room services. On April 2, 2021, DCM discovered the data of some of its patients was accessible over the Internet. DCM contacted Medifies about the exposed data and the issue was corrected the same day and the data was secured.

The investigation into the breach confirmed an error had been made when performing a software update which allowed the data to be accessed via the Internet. The error was made by a Medifies software development contractor.

The software update that made the information accessible occurred in December 2019, which meant patient data had been exposed online for more than a year, during which time it is possible that it was found and viewed by unauthorized individuals. No evidence was found to suggest any of the exposed information was viewed by unauthorized individuals.

Get The Checklist

Free and Immediate Download
HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The exposed data varied from patient to patient and may have included name, address, email address, date of birth, general procedure information, procedure date, and physician name. The names, addresses, email addresses, and cell phone numbers of significant others who may have subscribed to receive updates regarding a patient’s procedure may also have been exposed.

DCM had previously terminated its business relationship with Medifies but has been working closely with the company to investigate the breach. The types of information exposed should not put people at risk of identity theft; however, out of an abundance of caution, affected individuals have been offered complimentary credit monitoring services for one year and have until April 23, 2022 to activate those services.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.