Assured Imaging assuredimaging.com Assured Imaging data breach: what happened and what to do
Ransomware hit a server at Assured Imaging, a medical imaging provider, in May 2020. It exposed health records of 244,813 patients, including names, addresses, birth dates, diagnoses, lab results and medications. Assured later paid $375,000 to settle with the US health regulator.
View all 13,177 breaches- Breach date
- 15 May 2020
- Affected
- 244,813
- Data exposed
- Names, Addresses, Dates of birth, Diagnoses and conditions, Lab results, Medications, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Assured Imaging provides medical imaging and screening services in a dozen US states, including Arizona, California, Texas and New York. On May 19, 2020, the company found that ransomware had infected a server on its network. It reported the breach to the US Department of Health and Human Services (HHS) on August 27, 2020. HHS lists 244,813 people as affected.
What was exposed
According to HHS, the records included patient names, addresses and dates of birth, plus diagnoses and conditions, lab results, medications and treatment information. Nothing in HHS's description mentions Social Security numbers or card numbers.
Health details like these are what make a medical breach different. A scammer who knows your medication or a recent scan can write a message that sounds like it comes from your clinic or insurer. The name, address and birth date together also help someone pose as you when they call a provider or insurer.
The regulator's findings
HHS's Office for Civil Rights investigated and found that Assured had impermissibly disclosed patient information, hadn't done an accurate and thorough risk analysis, and hadn't notified the people affected in time. Assured paid $375,000 and agreed to a two-year corrective action plan that OCR monitors.
Was your data involved?
Assured should have written to anyone affected. If you had imaging done by one of its sites around 2020 and never got a letter, ask the provider directly.
Sources checked: hhs.gov, ocrportal.hhs.gov, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Expect messages that mention the breach
Criminals use your name, address and the type of care you had to make scam emails, texts and calls sound real. Don't click links or call numbers in them. Go to the company's own site, or call the number on your card or statement.
- 2
Read your health insurance statements
Check explanation of benefits statements and medical bills for care you didn't get. If you see something wrong, call your insurer and the provider's billing office, and report it to the FTC at IdentityTheft.gov.
- 3
Ask for your records and a list of disclosures
Under HIPAA you can ask a provider for a copy of your records and an accounting of disclosures. Use it if you suspect someone used your details to get care.
- 4
Check where else your details are exposed
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus can't remove breach data, but it alerts you when your details turn up so you know when to repeat these steps.
Official filings
- U.S. Department of Health and Human Services , filed 27 Aug 2020 : 244,813 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Assured Imaging breach?
HHS lists 244,813 people. The company was required to send letters, so check your mail from around 2020 and contact Assured if you used its services and heard nothing.
What was exposed?
Names, addresses, dates of birth, diagnoses and conditions, lab results, medications and treatment information, according to HHS.
Did Assured pay a penalty?
Yes. HHS says Assured paid $375,000 and agreed to a corrective action plan monitored by OCR for two years.
Should I change my password?
The sources don't describe passwords being taken. If you have a patient portal login, a fresh unique password costs nothing.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
