Medical Informatics Engineering mieweb.com Medical Informatics Engineering data breach: what happened and what to do
In 2015, hackers used a compromised user ID and password to reach the health records of about 3.5 million people held by Medical Informatics Engineering. The company reported it to HHS on July 23, 2015 and later paid $100,000 to settle HIPAA violations.
View all 13,177 breaches- Breach date
- 23 Jul 2015
- Affected
- 3,500,000
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Medical Informatics Engineering (MIE) is an Indiana company that provides software and electronic medical record services to healthcare providers. On July 23, 2015, it filed a breach report with the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services after it found that hackers had used a compromised user ID and password to reach electronic protected health information. The report covered about 3.5 million people.
What OCR found
OCR's investigation concluded that MIE had not done a comprehensive risk analysis before the breach. HIPAA requires organizations that hold health data to assess the risks to it. MIE paid $100,000 to OCR and agreed to a corrective action plan that includes a complete, enterprise-wide risk analysis. Coverage of the settlement reports that MIE did not admit wrongdoing.
What was exposed
OCR's announcement says the breach involved electronic protected health information, and it doesn't list data types. Coverage of the incident describes the affected data as patient records held for MIE's healthcare clients, so you may never have heard of MIE even if your records were involved. Health records can include names, addresses, dates of birth, Social Security numbers and insurance details, which is why the steps below cover identity theft and medical identity theft.
Why a vendor breach matters
You don't pick the software vendors your doctor uses. That makes it hard to know whether your data was in a breach like this one. If you received a notice letter in 2015 or 2016, treat it seriously. If you didn't, a credit freeze is still a free precaution the FTC recommends when identity data may be out there.
Sources checked: consumer.ftc.gov, identitytheft.gov, ocrportal.hhs.gov
Last verified against the official page:
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze stops lenders from seeing your credit report, which blocks most new accounts in your name. The FTC says it's free and you place it separately at Equifax, Experian and TransUnion. You lift it temporarily when you apply for credit yourself.
- 2
Look at your credit reports and statements
Order your free credit reports and look for accounts or inquiries you don't recognize. Read your bank, card and insurance statements for charges or claims you didn't make. The FTC's IdentityTheft.gov/databreach page walks through the steps for the type of data that leaked.
- 3
Take the free credit monitoring if it's offered
If the organization offers free credit monitoring or identity theft protection, the FTC recommends taking it. Use the enrollment instructions in the letter you received, not a link in an unexpected message.
- 4
Expect scams that mention the incident
Anyone who knows you were affected can write or call as if they're helping. Don't give details to someone who contacted you first. Contact the organization using a number from its own website or your card or insurance ID.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when something new turns up. It can't remove data that has already leaked, so the steps above are still the fix.
Official filings
- U.S. Department of Health and Human Services , filed 23 Jul 2015 : 3,500,000 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the MIE breach?
About 3.5 million people were. The company's clients were healthcare providers, so your records may have been held by MIE through your doctor or hospital. If you received a notice letter, you were affected.
What was exposed?
HHS says electronic protected health information was accessed with a compromised user ID and password. It doesn't list the data types.
Was there a settlement?
Yes. MIE paid $100,000 to HHS's Office for Civil Rights and agreed to a corrective action plan, according to the HHS announcement.
Should I freeze my credit?
It's a free precaution the FTC recommends when data like a Social Security number may have been exposed.
Sources
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- hipaajournal.com/medical-informatics-engineering-settles-hipaa-breach-case-for-100000/
Something wrong or out of date? Tell us and we'll re-check it.
