Med Associates, Inc. medassociates.com Med Associates data breach 2018: what happened and what to do
An unauthorized person got into an employee's workstation at Med Associates, a New York healthcare billing company, and could reach the health information of about 276,057 people. Med Associates found the activity on March 22, 2018 and began notifying people on June 14, 2018.
View all 13,177 breaches- Breach date
- 22 Mar 2018
- Made public
- 14 Jun 2018
- Affected
- 276,057
- Data exposed
- Names, Dates of birth, Physical addresses, Medical information, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Med Associates, a medical billing and claims company based in Latham, New York, reported that an unauthorized individual gained access to an employee's workstation. According to the U.S. Department of Health and Human Services (HHS), the protected health information of approximately 276,057 people was reachable from it. News outlets reported about 270,000 people. The company noticed unusual activity on the workstation on March 22, 2018, and began notifying people and reported to HHS on June 14, 2018.
Sources checked: ocrportal.hhs.gov, healthcareitnews.com, scworld.com
Last verified against the official page:
What was exposed
HHS lists names, dates of birth, addresses, dates of service, diagnoses and other treatment and health insurance information. One news report quoted the company's president saying some Social Security numbers were involved, while another quoted her saying the vast majority of records did not include them. If you got a letter, it lists what applies to you.
What it means for you
Diagnosis and insurance details plus your name, address and date of birth are enough for medical identity theft and for convincing phishing that mentions a real provider. A leaked Social Security number would add the risk of new credit being opened in your name.
What Med Associates did
It offered affected people one year of credit monitoring and identity restoration through TransUnion and added administrative and technical safeguards. During the investigation it told HHS it was dissolving its business operations, and HHS closed its investigation.
What to do if you were in it
- 1
Read your notice and use the monitoring offer
If you got a letter, check which items it lists for you. The FTC recommends taking free credit monitoring when it's offered.
- 2
Freeze your credit if your Social Security number was included
A freeze is free at Equifax, Experian and TransUnion. The FTC explains how.
- 3
Check your insurance statements
Read explanation-of-benefits statements for services you didn't receive, and tell your insurer if you see any.
- 4
Expect healthcare phishing
Messages mentioning a visit, a bill or your insurer may be scams. Contact the provider using details from its own website, not from the message.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up, but it can't remove data from a breach.
Official filings
- U.S. Department of Health and Human Services , filed 14 Jun 2018 : 276,057 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Med Associates breach?
Med Associates sent notices to affected people, mostly in New York's Capital Region, with about 1,700 letters to people in Massachusetts, Vermont and Florida, according to news reports. If you didn't get a letter, you were probably not included.
What was exposed?
Names, dates of birth, addresses, dates of service, diagnoses and other treatment and health insurance information, per HHS.
Is there a settlement?
None of the sources used here mention one.
Should I change my password?
No account passwords are reported as exposed. Focus on your credit and your insurance statements.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- healthcareitnews.com/news/270000-patient-records-breached-med-associates-hack
- scworld.com/news/270000-med-associates-records-possibly-compromised-in-data-breach
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
