Chicago Physiatry Group Breach Not Disclosed To Patients Or HHS For 16 Months

Sometimes it is understandable if it takes a while for an organization to discover and then disclose a data breach. However, 16 months is a bit too long for most of us to feel comfortable or find forgivable. In the case of a Chicago based physiatry group that is exactly what happened. A breach was discovered in early December of 2016, but not disclosed to those affected until 16 months later. HIPAA regulations typically require notification to the Department of Health and Human Services (HHS) with 60 days if the breach affected more than 500 individuals. If it is estimated to be less than 500 affected, they have 60 days past the last day of the year in which the breach happened. Whichever the number, 60 days has long passed for both instances.

Data was disclosed via an upload to an unsecured publicly accessible repository and found by a security researcher. That person notified Integrated Rehab Consultants (IRC) who promptly took care of the issue. It was determined that a business associate had provided the information to a third party and that person actually uploaded it to the unsecured repository.

There may a few questions here. First, what the heck is physiatry and why should HHS be involved? Well, it’s a branch of medicine that seeks to help people with physical impairments regain functionality in limbs, ligaments, muscles, etc. They obviously deal with protected health information (PHI) and breaches are reportable to HHS.

Another question is what do you do if your PHI is accessed or potentially accessed by unauthorized parties? The main priority in this case it to thoroughly monitor your insurance benefit statements and any other documents that list what care you received from your providers. If anything looks amiss, contact them to clear it up.

Next, if you are victim of a breach and the organization offers credit monitoring and/or identity restoration services to you, take advantage of it. In this case, these are being offered to victims for 12 months. Remember that these services will not prevent someone from using your information fraudulently. They do alert you if someone requests your credit information and will help you restore it if they do. In many healthcare related breaches, social security numbers are accessed and that is what fraudsters need to essentially become you, should they choose. They also use these to commit healthcare fraud.

If you don’t need access to, or don’t need to apply for credit, find a new apartment, or otherwise have access to your credit history, consider freezing it. Congress recently passed legislation making it illegal for the credit bureaus to charge for this. If you were part of the Equifax breach last year, as nearly half the population of the U.S. was, it’s not a bad idea to do this if you can.

Also, keep close tabs on your credit reports and payment card charges. The information left open to the public here included name, visit date and status, medical provider information, birthdate, gender, address, admission date, treatment location, appointment visit ID, diagnosis codes, and procedure code. That is a lot of information for a criminal to have on someone.

Why did IRC keep this breach quiet for so long? Reportedly, they believed that only the researcher accessed it. However, last fall that was not definitive. IRC doesn’t believe the information was used in a malicious way. However, it cannot be sure, and you should not count on that. Make sure you take steps to prevent your identity from being stolen.