Northeast Radiology northeastradiology.com Northeast Radiology data breach: what happened and what to do
Between April 2019 and January 2020, unauthorized people accessed radiology images on a Northeast Radiology server. HHS lists 298,532 people notified. The practice later paid $350,000 to settle with HHS.
View all 13,177 breaches- Breach date
- Apr 2019
- Affected
- 298,532
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Northeast Radiology, a medical imaging provider with centers in New York and Connecticut, reported to HHS's Office for Civil Rights in March 2020 that unauthorized people had accessed radiology images stored on its picture archiving and communication system (PACS) server between April 2019 and January 2020. It notified 298,532 patients whose information could be reached through that server. The case is listed on the HHS breach portal.
Sources checked: ocrportal.hhs.gov, hhs.gov, consumer.ftc.gov
Last verified against the official page:
What was exposed
The public description names radiology images stored on the server. It doesn't say which other details were attached to them, so check your notice letter for the list that applies to you.
Why imaging data matters
Radiology images are medical records. Even without an address or Social Security number attached, they show which scans you had and where. That is the kind of detail a scammer can use to pose as your provider or insurer, so be skeptical of any call or message that mentions your scans.
The response
HHS investigated and found the practice hadn't carried out an accurate and thorough risk analysis of its systems. Under a resolution agreement, Northeast Radiology paid $350,000 and agreed to a two-year corrective action plan that includes a new risk analysis and updated policies and staff training.
What to do if you were in it
- 1
Read your notice letter
It lists what was in your record. Act on that list rather than assuming the worst.
- 2
Freeze your credit if identity details were included
If your notice mentions a Social Security number or date of birth, place a free freeze at Equifax, Experian and TransUnion, as the FTC explains.
- 3
Check insurance statements
Look for treatment you didn't get and report it to your insurer.
- 4
Treat messages about your scans with suspicion
Don't click links in emails or texts about your imaging or this breach. Call the number on your bill.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new one.
Official filings
- U.S. Department of Health and Human Services , filed 11 Mar 2020 : 298,532 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Northeast Radiology breach?
The practice notified 298,532 patients. If you had imaging there and got a letter, you were among them.
Is there a settlement?
HHS announced a $350,000 settlement with Northeast Radiology. That resolved the regulator's HIPAA investigation; this page doesn't cover any claims process for patients.
What was exposed?
Radiology images stored on the practice's server. Your letter lists any other details in your record.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
