HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Potential Data Theft Incident Reported by Austin Manual Therapy

1,750 patients of Austin Manual Therapy (AMT) have been notified that some of their protected health information may have been accessed and stolen by a criminal attacker who gained access to AMT’s computer system.

A forensic investigation by a leading national cybersecurity team revealed access was first gained on October 3, 2017 and continued until October 9, when the intrusion was detected and blocked. According to the breach notice posted on the AMT website, access was not gained to the company’s electronic medical record system. Only a limited portion of the network was accessed – one computer and a shared file system.

While the forensic investigation confirmed that access to some files had been gained, it was not clear how much information was viewed and which, if any, documents had been stolen. An analysis of the file system and computer showed that the following information could have been accessed: Names, addresses, dates of birth, phone numbers, dates of service, charge amounts, occupations, insurance coverage and policy information, health screening information, diagnoses, driver’s license information, referring physician information, and partial and full Social Security numbers.

The breach investigation has largely been completed, although TMD said it is continuing to actively work with forensic investigators and that the investigation will likely continue until the end of the year.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Additional security measures have now been implemented to prevent this type of attack from occurring in the future. While the exact nature of the attack was not detailed in the TMD breach report, Databreaches.net has reported that this was an extortion attempt by the hacking group TheDarkOverlord.

Individuals impacted by the breach have been advised that they can obtain free credit reports and place a fraud alert and security freeze on their accounts, but it would not appear that credit monitoring or identity theft protection services have been offered.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.