An intruder spent ten days inside the network of a Pennsylvania medical management and billing firm, and patients are now getting breach notices.
Allentown-based Secure Healthcare Information Management said in its notice that an unauthorized third party reached its systems. The intrusion window ran from July 6 to July 16, with a disruption surfacing on July 17. A review wrapped up on September 18 and concluded that several record categories had been exposed and potentially obtained: health insurance and medical information, driver’s license numbers and birth dates among them. Social Security numbers and names also sat in the exposed set.
Letters went out starting October 6 alongside free identity protection. Federal regulators at the HHS Office for Civil Rights were alerted, but because the matter has yet to surface on the OCR breach portal, how many people are affected cannot be pinned down.
A second notice comes from Desert Orthopaedic Center, a five-site orthopedic practice in Las Vegas and Henderson, Nevada. Access there was spotted on or around August 7. Clinical and treatment records topped what the practice flagged, alongside prescriptions and medication logs, service dates, and the names and locations of providers. Record and account identifiers, Medicare and Medicaid IDs, coverage and claims details, contact information, birth dates and Social Security numbers rounded out the list.
This is the part provider organizations should weigh. One billing or management vendor can simultaneously hold records for many practices, so a single compromise cascades across an entire client roster at once. Security teams ought to map which revenue-cycle, coding and billing partners touch patient data, verify each is covered by an up-to-date business associate agreement, and insist on rapid notification when an incident occurs.
