Cardiovascular Associates cvapc.com Cardiovascular Associates data breach: what happened and what to do
Cardiovascular Associates, a Birmingham, Alabama cardiology practice, reported a hacking incident that began on November 28, 2022 and affected 433,348 people, per HHS. Exposed data included names, Social Security numbers, health insurance and medical information, and some passport and driver's license numbers.
View all 13,177 breaches- Breach date
- 28 Nov 2022
- Affected
- 433,348
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Health insurance information, Medical information, Passport numbers, Driver's licenses, Bank account numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Cardiovascular Associates (CVA) is a cardiology practice with locations in and around Birmingham, Alabama. It found on December 5, 2022 that unauthorized activity had taken place on systems in its network. Reporting on the incident puts the activity between November 28 and December 5, 2022. The first patient notices went out in February 2023, and further letters in March 2023 went to current and former employees and staff of an affiliated practice.
CVA told the U.S. Department of Health and Human Services (HHS) that the incident affected the protected health information of 433,348 people. Other outlets have reported slightly different totals, so this page uses the HHS figure.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
According to HHS's summary, the information involved included names, addresses, dates of birth, Social Security numbers, health insurance information, medical and treatment information, billing and claims information, passport and driver's license numbers, and financial information. Not every item applied to every person.
Names with Social Security numbers and dates of birth are what criminals need to open credit in someone else's name. Medical and insurance details make phishing calls and texts more convincing, because the caller can quote a real provider or plan.
The company's response
CVA notified HHS, the people affected and the media, and posted a notice on its website. It offered free credit monitoring and put additional administrative, technical and security safeguards in place. Staff were trained on protecting health information. A class action over the breach was filed after the notices went out.
What to do if you were in it
- 1
Read your letter and use the credit monitoring offer
If CVA wrote to you, the letter says which of your details were involved. The FTC recommends taking up free credit monitoring when a company offers it. Enrollment windows for 2023 notices have likely closed, so contact CVA if you never got a letter.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops most new accounts being opened in your name. You place it separately at Equifax, Experian and TransUnion, and lift it when you apply for credit yourself. The FTC explains the steps.
- 3
Read your insurance statements
Check explanation of benefits statements and medical bills for services you didn't receive, and report anything odd to your insurer.
- 4
Expect phishing that mentions your care
Treat unexpected calls, texts or emails about your health plan, billing or a refund with suspicion. Contact the provider or insurer on a number you already have.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan for your email address and phone number against breach databases and the dark web, and alerts you when something new shows up. Breach data can't be taken back from the places it spread to, so the scan tells you what to act on.
Official filings
- U.S. Department of Health and Human Services , filed 3 Feb 2023 : 433,348 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Cardiovascular Associates breach?
Anyone whose data was involved should have received a letter, mailed from February 2023. If you were a CVA patient or employee and never got one, ask CVA directly.
What was exposed in the Cardiovascular Associates breach?
HHS's summary lists names, addresses, dates of birth, Social Security numbers, health insurance information, medical and treatment information, billing and claims information, passport and driver's license numbers and financial information. It varied by person.
How many people were affected?
HHS lists 433,348 people. Some news outlets reported a slightly higher total.
Should I freeze my credit?
If your Social Security number was involved, the FTC says a freeze is a free way to block new accounts opened in your name.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- identitytheft.gov/databreach
- techtarget.com/healthtechsecurity/news/366593885/3-Organizations-Report-Recent-Healthcare-Data-Breaches
- abc3340.com/newsletter-daily/cva-reports-data-security-breach-of-some-patient-information-cardiovascular-associates-birmingham-hospitals-personal-cardiologist-doctor-hospital
- ago.vermont.gov/sites/ago/files/2023-02/2023-02-03%20%20Cardiovascular%20Associates%20Data%20Breach%20Notice%20to%20Consumers.pdf
Something wrong or out of date? Tell us and we'll re-check it.
