Another (!) Orthopedic Practice Reports Data Breach

This year alone, more than 200 data breach incidence have been reported to the U.S. Government’s Human Health Services department affecting more than 14.5 million people.

Now add Poughkeepsie, New York-based Orthopedic Associates of Dutchess County, which notified current and former patients of a security incident potentially compromising patient health information, to that list.

According to the notice posted on its website, Orthopedic Associates of Dutchess County “became aware of suspicious activity relating to its systems” on March 5, 2021. It immediately began an investigation to “determine the nature and scope of the activity.”

The investigation revealed that on March 1, 2021, “an unauthorized actor gained access” to Orthopedic Associates of Dutchess County systems, “encrypted certain systems, and claims to have removed and/or viewed certain files.” Orthopedic Associates of Dutchess County has not been able to uncover the full scope of patient data that may have potentially been removed and/or viewed.

While Orthopedic Associates of Dutchess County has not been able to confirm what information was taken, it is possible that a large amount of patient information was exposed in the breach. Information that the breach may have been compromised includes “individual’s name, address, telephone number, email address, emergency contact, guarantor, patient identification number, medical record number, diagnosis information, health insurance number and other health insurance information, payment details, date of birth, Social Security number, and treatment information.”

In addition to the investigation, Orthopedic Associates of Dutchess County has taken steps to evaluate and improve its current policies and procedures. It has also provided notices about the incident to the Federal Bureau of Investigation (FBI) and the Department of Health and Human Services (HHS).

In 2021, 222 data breach incidences affecting 500 or more people have been reported to HHS. These incidences have affected more than 14,577,840 individuals. Among those reported this year, 13 were from New York.

For OTW’s recent coverage of data breach incidences, see “Maryland Ortho Practice Data Breach Exposes Over 125,000 People” and “Michigan Orthopedic Practice Reports Data Breach.”