CT orthopedic practice reports data breach affecting nearly 22,000 people

A Connecticut orthopedic practice with offices in Wallingford and Southington has reported a data breach affecting nearly 22,000 people that potentially exposed Social Security numbers, financial information and medical records. Comprehensive Orthopedics & Musculoskeletal Care LLC, with clinics at 863 North Main St. in Wallingford and 601 N. Main St. in Southington, reported the breach to the U.S. Department of Health and Human Services’ Office for Civil Rights, which says 21,897 people were affected. The federal agency classifies the breach as a hacking or IT incident involving a network server. The incident was reported to HHS on Sept. 10 and remains under investigation by the Office for Civil Rights. Comprehensive Orthopedics disclosed the incident in an Aug. 14 notice posted to its website. According to the notice, the practice became aware of suspicious activity involving its network on Feb. 12 and took steps to secure its network. It also hired a third-party forensic firm to investigate. The investigation found that an unauthorized third party had accessed certain files. Comprehensive Orthopedics then reviewed those files to determine whether they contained personal or protected health information and whose information was involved. That review was completed June 17 and determined that the affected files may have contained protected health information, the notice states. Potentially compromised information included individuals’ first and last names along with one or more other pieces of information, including dates of birth, Social Security numbers, government-issued identification, financial account or payment card information, medical information and health insurance information. Comprehensive Orthopedics said that in response to the incident, it secured its network, reset passwords, secured accounts and conducted a full investigation. It also said it was mailing notification letters to potentially affected individuals. The practice advised affected individuals to monitor credit reports, financial account statements and health insurance explanation-of-benefits forms for suspicious activity. It also provided information about placing fraud alerts and credit freezes. HHS’ breach portal lists incidents involving unsecured protected health information affecting 500 or more people. The agency says its Office for Civil Rights investigates such breaches.