Cyberattack on Minnesota Radiology Practice Affects 584,000 Patients
The Edina, Minnesota-based radiology services company, Consulting Radiologists, has started sending individual notifications to the 583,824 patients affected by a February 2024 cyberattack.
Consulting Radiologists provides teleradiology-based interpretation services to more than 100 healthcare facilities in Minnesota. On February 12, 2024, suspicious activity was identified within its computer network and action was immediately taken to secure its systems and prevent any further unauthorized access. A third-party cybersecurity company was engaged to investigate the incident and confirmed that there had been an intrusion and an unauthorized third party accessed a server that contained patient data.
Consulting Radiologists said it conducted a time-consuming and detailed reconstruction of the server to determine which patients had been affected and the types of data involved. The review confirmed on April 17, 2024, that patient data had been exposed and potentially acquired, including names, addresses, dates of birth, medical information, and health insurance information. The types of data varied from patient to patient and a small subset of patients also had their Social Security numbers, driver’s license numbers, and/or face sheets and imaging reports exposed.
Consulting Radiologists said it has deployed additional monitoring tools and will look at further ways of securing its systems and data. While patient data has been exposed, at the time of issuing notification letters, Consulting Radiologists had not detected any actual or attempted misuse of patient data in connection with the security incident. As a precaution, 12 months of complimentary single bureau credit monitoring, credit report, and credit score services have been offered to individuals whose Social Security numbers were compromised.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The breach was initially reported to the Maine Attorney General as affecting 511,947 individuals, including 47 Maine residents; but has now been updated to 580,703 affected individuals, including 61 Maine residents. The HIPAA breach has been reported to the HHS’ Office for Civil Rights as involving the protected health information of 583,824 individuals.
