Notice of Data Incident
August 1, 2023

Dear Patients:
We post this Notice pursuant to the United States Health Insurance Portability and Accountability Act (“HIPAA”) to inform you about a data incident involving an unauthorized release of patient Protected Health Information (“PHI”), as that is defined by HIPAA, at Gary Motykie, M.D., a Medical Corporation and Gary Motykie, M.D. (“Practice”), a covered entity under HIPAA.

PHI, as defined by HIPAA, is information that is “created, received, maintained, or transmitted by or on behalf of the health care component of the Covered Entity.” § 164.105 (a)(2)(i)(D). Information that is created or received by a Covered Entity and that relates to the past, present, or future physical or mental health or condition of an individual; or the past, present, or future payment for the provision of healthcare to an individual is considered PHI. PHI is required to be protected when transmitted or maintained in any form by a Covered Entity. Individual identifiers (including but not limited to name, address, telephone number, fax, email address, social security number, medical record number, etc.) maintained in a designated record set along with health information (including but not limited to x-rays, images, scans, physician notes, diagnoses, treatment, eligibility approvals, claims, remittances, etc.) are collectively considered PHI.

Event Description:
On or about June 6, 2023, an initial technical analysis of the Practice’s information technology network determined an unauthorized release of PHI occurred to an unknown third party. The initial analysis determined that the unknown third party accessed the Practice’s network. It was further determined that the unknown third party acquired some of the Practice’s patient’s unencrypted PHI and that party was not authorized to do so and did so in an unlawful manner.

The information that may have been accessed or acquired during this unauthorized access included:

  • First and last name 
  • Social Security Number (if provided)
  • Address
  • Driver’s license or identification card number
  • Financial account or payment card number, in combination with any required CVV code
  • Intake forms, which may include medical information and history
  • Images taken in connection with the services rendered at our office
  • Health insurance information (if provided)
Steps Taken to Address:
Upon discovery, the Practice took the following immediate steps to address the situation:
  • Computers and servers replaced
  • Network passwords changed
  • Endpoint detection, virus, and malware detection tools and software installed on workstations and server
  • Limitations concerning Internet access
  • Access controls put in place for users based on role and responsibility
  • Server policies in place
  • Device locking mechanisms
  • Multi factor authentication enabled
  • Network segregation efforts
  • Encryption of devices
  • Additional workforce training
Risk Assessment:

The Practice conducted a risk assessment to evaluate the potential harm to potentially impacted individuals. Based on that assessment, it is determined that there is a high risk of harm. It is essential for potentially impacted individuals to remain vigilant in monitoring their personal accounts and data and promptly report any suspicious activity to law enforcement or their financial institutions.

Assistance and Resources:
Starting on or about June 22, 2023, letters were mailed to patients providing the following resources to assist the potentially impacted individuals, offering at no cost:
  • two (2) years of no cost Triple Bureau Credit Monitoring/Triple Bureau Credit Report/Triple Bureau Credit Score/Cyber Monitoring services.
  • the services also include reviewing whether Information appears on the dark web and alert the individual if such Information is found online.
  • proactive fraud assistance to help with any questions in event a potentially impacted persons becomes a victim of fraud.

Steps to Prevent Future Incidents: We deeply regret any inconvenience or concern this Incident may cause. The Practice is taking numerous steps to help prevent similar Incidents in the future. We will continue to review and enhance our security measures, policies, and employee training.

If you failed to receive your letter in the mail, and/or if there is a concern your mailing address has changed since you were a patient at the Practice, please contact 1-800-405-6108 or call our office immediately at 310-246-2355 from 9:00 am to 5:00 pm Pacific time, Monday through Friday.

Blog

Dr. Motykie Launch’s New Website

LOS ANGELES, CA — Dr. Gary Motykie, Inc., announced today the March 1st that he will launch of a newly redesigned website at www.drmotykie.com at the end of the month.  Site visitors will find updated site information,  an expanded gallery and patient education section along with complete descriptions of Dr. Motykie’s products and services.

Of the website upgrades, Dr. Motykie says, “I consistently strive to promote and advance the expanding field of plastic surgery through my consistent involvement in television, radio and written media.  It takes extra effort to stay at the forefront of a field that is constantly changing, but I believe that it is essential in order to keep myself and my patients well-informed about the newest and best surgical techniques currently available worldwide.”

Dr. Motykie is a board certified plastic surgeon who specializes in breast surgery, body contouring, rhinoplasty and facial rejuvenation as well as numerous other cosmetic surgical procedures. He has been featured in articles in the New York Times, LA Times and Wall Street Journal as well as having featured appearances on Dr Phil, EXTRA, ACCESS Hollywood, SPIKE TV and Inside Edition. He is currently featured on both the E! Entertainment’s series Dr. 90210 and the Discovery Channel’s Plastic Surgery: Before & After.

Spread the love

Comments are closed.