A Connecticut orthopedic practice has reported a data breach affecting nearly 22,000 people after hackers reached a network server holding patient information.
Comprehensive Orthopedics & Musculoskeletal Care LLC, with clinics in Wallingford and Southington, told the U.S. Department of Health and Human Services’ Office for Civil Rights that 21,897 people were affected. The agency classifies the incident as a hacking or IT incident involving a network server. The practice reported it to HHS on Sept. 10.
The practice first disclosed the incident in an Aug. 14 notice. It says it spotted suspicious activity on its network on Feb. 12 and moved to secure it, then brought in an outside forensic firm. That review, completed June 17, found that an unauthorized party had accessed files that may have contained protected health information.
Potentially exposed data included names along with dates of birth, Social Security numbers, government-issued identification, financial account or payment card information, medical information and health insurance details.
Comprehensive Orthopedics said it secured its network, reset passwords and secured accounts, and is mailing notice letters. The case is a familiar profile for the sector: a single-practice provider, a months-long gap between intrusion and discovery, and Social Security numbers in the exposed set, the combination that drives both regulatory scrutiny and follow-on class action risk.
