San Diego Family Care began notifying 125,500 patients that their protected health information was potentially stolen in a vendor data breach that shut down its systems and encrypted patients' data.
Letters were mailed on May 7 to each of the patients affected by the breach, according to a May news release on the data incident.
Five details:
1. In December, San Diego Family Care and its business associate Health Center Partners of Southern California learned their IT hosting provider experienced a data breach that resulted in its data being encrypted.
2. The hosting provider was able to secure the data and eventually restore its systems. Soon after, it launched an investigation with the help of computer forensics experts.
3. On Jan. 20, the clinic learned its data and Health Center Partners' data may have been accessed or acquired by an unauthorized party and launched a review investigating the scope of the breach.
4. The review concluded on April 12 and found that the information breached may include patients' names, Social Security numbers and financial account numbers.
5. The clinic is working with its hosting provider to reduce the likelihood of a similar event occurring again. In addition, the clinic is offering identity protection services through identity theft provider IDX, which includes 12 months of credit monitoring, a $1 million insurance reimbursement policy and fully managed identity theft recovery services.