August 1, 2023
Dear Patients:
We post this Notice pursuant to the United States Health Insurance Portability and Accountability Act (“HIPAA”) to inform you about a data incident involving an unauthorized release of patient Protected Health Information (“PHI”), as that is defined by HIPAA, at Gary Motykie, M.D., a Medical Corporation and Gary Motykie, M.D. (“Practice”), a covered entity under HIPAA.
PHI, as defined by HIPAA, is information that is “created, received, maintained, or transmitted by or on behalf of the health care component of the Covered Entity.” § 164.105 (a)(2)(i)(D). Information that is created or received by a Covered Entity and that relates to the past, present, or future physical or mental health or condition of an individual; or the past, present, or future payment for the provision of healthcare to an individual is considered PHI. PHI is required to be protected when transmitted or maintained in any form by a Covered Entity. Individual identifiers (including but not limited to name, address, telephone number, fax, email address, social security number, medical record number, etc.) maintained in a designated record set along with health information (including but not limited to x-rays, images, scans, physician notes, diagnoses, treatment, eligibility approvals, claims, remittances, etc.) are collectively considered PHI.
Event Description:
On or about June 6, 2023, an initial technical analysis of the Practice’s information technology network determined an unauthorized release of PHI occurred to an unknown third party. The initial analysis determined that the unknown third party accessed the Practice’s network. It was further determined that the unknown third party acquired some of the Practice’s patient’s unencrypted PHI and that party was not authorized to do so and did so in an unlawful manner.
The information that may have been accessed or acquired during this unauthorized access included:
- First and last name
- Social Security Number (if provided)
- Address
- Driver’s license or identification card number
- Financial account or payment card number, in combination with any required CVV code
- Intake forms, which may include medical information and history
- Images taken in connection with the services rendered at our office
- Health insurance information (if provided)
Steps Taken to Address:
Upon discovery, the Practice took the following immediate steps to address the situation:
- Computers and servers replaced
- Network passwords changed
- Endpoint detection, virus, and malware detection tools and software installed on workstations and server
- Limitations concerning Internet access
- Access controls put in place for users based on role and responsibility
- Server policies in place
- Device locking mechanisms
- Multi factor authentication enabled
- Network segregation efforts
- Encryption of devices
- Additional workforce training
Risk Assessment:
The Practice conducted a risk assessment to evaluate the potential harm to potentially impacted individuals. Based on that assessment, it is determined that there is a high risk of harm. It is essential for potentially impacted individuals to remain vigilant in monitoring their personal accounts and data and promptly report any suspicious activity to law enforcement or their financial institutions.
Assistance and Resources:
Starting on or about June 22, 2023, letters were mailed to patients providing the following resources to assist the potentially impacted individuals, offering at no cost:
- two (2) years of no cost Triple Bureau Credit Monitoring/Triple Bureau Credit Report/Triple Bureau Credit Score/Cyber Monitoring services.
- the services also include reviewing whether Information appears on the dark web and alert the individual if such Information is found online.
- proactive fraud assistance to help with any questions in event a potentially impacted persons becomes a victim of fraud.
Steps to Prevent Future Incidents:
We deeply regret any inconvenience or concern this Incident may cause. The Practice is taking numerous steps to help prevent similar Incidents in the future. We will continue to review and enhance our security measures, policies, and employee training.
If you failed to receive your letter in the mail, and/or if there is a concern your mailing address has changed since you were a patient at the Practice, please contact 1-800-405-6108 or call our office immediately at 310-246-2355 from 9:00 am to 5:00 pm Pacific time, Monday through Friday.
