The San Antonio, TX, Advanced Spine & Pain Center (ASPC) has advised clients of a possible breach that could have affected as many as 8,362 patients.
ASPC became aware of a potential violation of ePHI on July 31, 2017 when some clients reported receiving a telephone call advising payment for an outstanding bill must be made. An investigation was initiated to determine whether ASPC systems had been breached.
That review showed unauthorized people had gained access to an ASPC server. Unauthorized access happened even though extensive security measures had been implemented, including firewalls, network filtering, security monitoring, password protection, and antivirus software.
While unauthorized access was established as having occurred, it was unclear whether any sensitive data was accessed by those attackers. It was also not possible to definitively determine whether the telephone calls received by some patients were due to the security breach.
Since the patients’ ePHI may have been viewed or obtained by unauthorized people, ASPC has offered all affected patients identity theft protection services and coverage with a $1,000,000 insurance reimbursement policy. A full network review has been completed and action has been taken to ensure the network is safe and secured. Recent monitoring of the network has not found any proof of ongoing unauthorized access and the breach is thought to have been controlled.
An analysis of the compromised server has identified that the following PHI may have been obtained: Names, addresses, telephone numbers, state and zip codes, Social Security details, birth dates, medical histories, x-ray images and lab test results, scheduling notes, billing information, insurance information, CPT codes, ID numbers, group numbers, and patients’ gender. No payment information or credit/debit cards were obtained.
The hacking incident has been made known to law enforcement agencies and the Department of Health and Human Services’ Office for Civil Rights has been provided with an official report as well..
