Concentra concentra.com Concentra data breach: what happened and what to do
HHS lists a Concentra breach in which an unencrypted laptop with the health information of about 900 patients was stolen from one of its facilities. The data included demographic and clinical details. Concentra notified patients, HHS and the media.
View all 13,177 breaches- Breach date
- 19 Jan 2010
- Made public
- 19 Jan 2010
- Affected
- 900
- Data exposed
- Demographic information, Medical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
An unencrypted laptop computer was stolen from one of Concentra's facilities. According to the U.S. Department of Health and Human Services (HHS), it held the electronic protected health information of approximately 900 patients. HHS added the case to its breach list in January 2010. HHS doesn't give the date of the theft, so the date shown on this page is the date of the listing.
Sources checked: ocrportal.hhs.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS describes the information as demographic and clinical data. It doesn't list Social Security numbers, financial details or passwords, so don't assume those were involved. Demographic data typically means identifying details like a name and contact information, and clinical data means medical information.
Even without financial data, medical details can be used to craft believable scam calls or to embarrass someone. They shouldn't be dismissed because the group affected was small.
The company's response
After the theft, Concentra filed a police report and notified affected patients, HHS and the media. HHS's Office for Civil Rights then investigated. Concentra required all of its business units to identify any devices that contain protected health information and revised its procedures for buying computers. It put physical and technical safeguards on testing devices and replaced outdated machines that couldn't be encrypted. It also changed its physician agreements so doctors can't use equipment with unencrypted patient data. OCR accepted that corrective action.
What this means for you
If you got a notice, read it for what was taken. The steps below are sensible after any health data leak.
What to do if you were in it
- 1
Read your statements and explanation of benefits
Look for charges, accounts or medical services you don't recognize, and report anything odd to the company that sent it.
- 2
Expect messages that mention the breach
Scammers write to affected people with real details to sound credible. Don't click links in unexpected emails or texts. Go to the company's own site or the phone number on your card.
- 3
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email, phone and other details and alerts you when they appear in a new leak.
Official filings
- U.S. Department of Health and Human Services , filed 19 Jan 2010 : 900 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Concentra breach?
Concentra notified affected patients. HHS lists about 900 people. If you got a letter, you were included.
What was exposed?
HHS describes demographic and clinical data. It doesn't list Social Security numbers or financial details.
How did the breach happen?
An unencrypted laptop was stolen from one of Concentra's facilities, per HHS.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
