MedEvolve medevolve.com MedEvolve data breach: what happened and what to do
A misconfigured MedEvolve FTP server left patient records open to the internet for about four months in 2018. HHS says 230,572 people were affected. Exposed data included names, addresses, phone numbers, insurer and account numbers, and some Social Security numbers.
View all 13,177 breaches- Breach date
- 29 Mar 2018
- Affected
- 230,572
- Data exposed
- Names, Physical addresses, Phone numbers, Health insurance information, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
MedEvolve, an Arkansas company that sells practice management and revenue cycle software to healthcare providers, exposed patient records through a misconfigured File Transfer Protocol (FTP) server. The server was open to the internet, so anyone who found it could read what was on it.
What happened
MedEvolve reported the exposure in a breach notification, and the U.S. Department of Health and Human Services' Office for Civil Rights (OCR) opened an investigation in July 2018. OCR later found that at least one unauthorized person viewed the records during the roughly four months the server was publicly reachable. MedEvolve described the cause as a single human error.
In 2023 OCR announced a settlement. MedEvolve paid $350,000. It also agreed to a corrective action plan that OCR monitors for two years. OCR said the company had not done an organization-wide risk analysis and had not signed a business associate agreement with a subcontractor. OCR puts the number of people affected at 230,572.
Sources checked: bankinfosecurity.com, healthitsecurity.com, ocrportal.hhs.gov
Last verified against the official page:
What was exposed
The files held patient names and billing addresses, plus telephone numbers. They also listed each person's primary health insurer and a doctor's office account number. Some people's Social Security numbers were in there too.
What that means for you
A name, address and phone number are enough for convincing phishing calls and texts that mention your doctor or insurer. A Social Security number is the bigger risk, because it can be used to open credit or file taxes in your name. Insurer details can feed medical billing fraud.
If you were a patient of a practice that used MedEvolve, the practice or MedEvolve should have written to you. If you got a letter, take it seriously and use the steps below.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze stops new accounts from being opened in your name. It's free, and you place it separately with Equifax, Experian and TransUnion. The FTC explains how in its guide to credit freezes and fraud alerts.
- 2
Read your statements and credit reports
Look for charges or accounts you don't recognize. You can get your free credit reports at AnnualCreditReport.com. If something is wrong, report it at IdentityTheft.gov, the FTC's reporting site.
- 3
Check your explanation of benefits
Read the statements your health insurer sends. Report visits, prescriptions or bills you don't recognize to your insurer. The FTC's data breach guidance covers what to do when health information is exposed.
- 4
Treat messages that mention the breach with suspicion
Criminals send fake notices that use real breach details. Don't click links or call numbers in an unexpected email, text or letter. Go to the company's website yourself, or use a phone number you already trust.
- 5
Check whether your email or phone number shows up in this and other breaches
A free Serus scan checks your email and phone number against breach databases and tells you what to do about anything it finds. Serus can't remove data from a breach, but it alerts you when new exposures appear.
Official filings
- U.S. Department of Health and Human Services , filed 10 Jul 2018 : 205,434 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the MedEvolve breach?
MedEvolve's customers are healthcare providers, so patients usually hear from their provider or from MedEvolve by letter. If you didn't get a notice, you can still freeze your credit as a precaution.
What was exposed in the MedEvolve breach?
Patient names, billing addresses, phone numbers, primary health insurer and doctor's office account numbers, and in some cases Social Security numbers.
Was there a settlement?
HHS OCR announced a $350,000 settlement with MedEvolve in 2023 over violations of the HIPAA Security Rule. That settlement is with the regulator and doesn't pay patients directly.
Should I freeze my credit?
If your Social Security number may have been exposed, the FTC recommends considering a credit freeze. It's free and you can lift it when you need credit.
Sources
- bankinfosecurity.com/feds-hit-vendor-350k-settlement-in-ftp-server-breach-a-22084
- healthitsecurity.com/news/ocr-settles-hipaa-investigation-with-revenue-cycle-management-company
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
