A multispecialty group serving the San Francisco Bay Area has begun mailing notices after an intrusion that ran undetected for nearly three weeks. BASS Medical Group said it spotted suspicious activity in its network environment around September 4 and needed until roughly September 22 to confirm that personal and protected health information had been looked at or taken.
The notice, posted October 22, lists medical treatment codes, billing records and health insurance information among the exposed data categories. Notice letters are going out now. The practice has not published an affected headcount, and no entry for the incident appears in the federal breach portal yet.
Treatment codes are the quiet risk in a disclosure like this. A procedure or diagnosis code attached to a name is enough to infer a condition, so a file set of codes and billing lines carries far more clinical meaning than its size suggests.
Attorneys are already soliciting affected patients, the usual precursor to a class action. For other medical groups, the timeline is the lesson: eighteen days from first signal to confirmed scope is well inside normal forensic range, which means containment and patient communication run on forensic time, not on the practice’s operations calendar.
BASS has not commented publicly on whether the incident involved ransomware or data theft.
