Notice of Data Incident
August 1, 2023

Dear Patients:
We post this Notice pursuant to the United States Health Insurance Portability and Accountability Act (“HIPAA”) to inform you about a data incident involving an unauthorized release of patient Protected Health Information (“PHI”), as that is defined by HIPAA, at Gary Motykie, M.D., a Medical Corporation and Gary Motykie, M.D. (“Practice”), a covered entity under HIPAA.

PHI, as defined by HIPAA, is information that is “created, received, maintained, or transmitted by or on behalf of the health care component of the Covered Entity.” § 164.105 (a)(2)(i)(D). Information that is created or received by a Covered Entity and that relates to the past, present, or future physical or mental health or condition of an individual; or the past, present, or future payment for the provision of healthcare to an individual is considered PHI. PHI is required to be protected when transmitted or maintained in any form by a Covered Entity. Individual identifiers (including but not limited to name, address, telephone number, fax, email address, social security number, medical record number, etc.) maintained in a designated record set along with health information (including but not limited to x-rays, images, scans, physician notes, diagnoses, treatment, eligibility approvals, claims, remittances, etc.) are collectively considered PHI.

Event Description:
On or about June 6, 2023, an initial technical analysis of the Practice’s information technology network determined an unauthorized release of PHI occurred to an unknown third party. The initial analysis determined that the unknown third party accessed the Practice’s network. It was further determined that the unknown third party acquired some of the Practice’s patient’s unencrypted PHI and that party was not authorized to do so and did so in an unlawful manner.

The information that may have been accessed or acquired during this unauthorized access included:

  • First and last name 
  • Social Security Number (if provided)
  • Address
  • Driver’s license or identification card number
  • Financial account or payment card number, in combination with any required CVV code
  • Intake forms, which may include medical information and history
  • Images taken in connection with the services rendered at our office
  • Health insurance information (if provided)
Steps Taken to Address:
Upon discovery, the Practice took the following immediate steps to address the situation:
  • Computers and servers replaced
  • Network passwords changed
  • Endpoint detection, virus, and malware detection tools and software installed on workstations and server
  • Limitations concerning Internet access
  • Access controls put in place for users based on role and responsibility
  • Server policies in place
  • Device locking mechanisms
  • Multi factor authentication enabled
  • Network segregation efforts
  • Encryption of devices
  • Additional workforce training
Risk Assessment:

The Practice conducted a risk assessment to evaluate the potential harm to potentially impacted individuals. Based on that assessment, it is determined that there is a high risk of harm. It is essential for potentially impacted individuals to remain vigilant in monitoring their personal accounts and data and promptly report any suspicious activity to law enforcement or their financial institutions.

Assistance and Resources:
Starting on or about June 22, 2023, letters were mailed to patients providing the following resources to assist the potentially impacted individuals, offering at no cost:
  • two (2) years of no cost Triple Bureau Credit Monitoring/Triple Bureau Credit Report/Triple Bureau Credit Score/Cyber Monitoring services.
  • the services also include reviewing whether Information appears on the dark web and alert the individual if such Information is found online.
  • proactive fraud assistance to help with any questions in event a potentially impacted persons becomes a victim of fraud.

Steps to Prevent Future Incidents: We deeply regret any inconvenience or concern this Incident may cause. The Practice is taking numerous steps to help prevent similar Incidents in the future. We will continue to review and enhance our security measures, policies, and employee training.

If you failed to receive your letter in the mail, and/or if there is a concern your mailing address has changed since you were a patient at the Practice, please contact 1-800-405-6108 or call our office immediately at 310-246-2355 from 9:00 am to 5:00 pm Pacific time, Monday through Friday.

Blog

Not all Surgery Centers are Created Equal

Where should you have your plastic surgery procedure performed?

Not all surgeries should be performed in a hospital. In fact, the majority of elective plastic surgery procedures are performed in an office-based facility. If your surgeon is going to perform your procedure in one of these types of facilities, you should check at least the following in order to make sure your surgery is being performed in a state-regulated, safe surgical facility.
1.    The Facility: Where your surgical procedure is going to be performed should be accredited and in good standing with at least one of the major accredited organizations.
a.    AAAASF (www.aaasf.org)
b.    JCAHO (www.jcaho.org)
c.    AAAHC (www.aaahc.org)

2.    Accreditation Standards:
a.    The medical staff must meet strict qualification standards
b.    The surgery center must pass regular inspections for safety,  sterility  and record-keeping
c.    The surgery center must pass a peer-reviewed quality-assessment inspection
d.    The surgery center must meet certain guidelines set forth for emergency equipment and the staff must be trained in advanced cardiac life support and lifesaving protocols

Remember, hospitals are big, expensive and literally full of sick people. They are therefore NOT the ideal place to have elective, plastic surgery. An office based surgery center offers privacy, comfort, quality staff and quality care. Surgery centers are also privately owned and operated so that they are typically run much more efficiently and the savings can therefore be passed onto you in the form of less fees and cost.  Once you have confirmed the safety of your facility by checking its accreditation online, you can enjoy the more streamlined and pleasant experience of having your surgery performed in an outpatient surgery center.

To see more services and treatments provided by Dr. Motykie and his team please visit:

Spread the love

Comments are closed.