Medical Review Institute of America mrioa.com Medical Review Institute of America data breach: what happened and what to do
Medical Review Institute of America, a clinical review vendor for health plans, reported a November 2021 cyberattack affecting 134,571 people. Data included names, addresses, dates of birth, Social Security numbers and medical details.
View all 13,177 breaches- Breach date
- 2 Nov 2021
- Affected
- 134,571
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Medical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Medical Review Institute of America (MRIoA) reviews medical claims for health plans, so many people in its files never dealt with it directly. HHS lists 134,571 people affected by its November 2021 cyberattack.
What happened
HHS gives the breach date as November 2, 2021. Press coverage says MRIoA discovered the intrusion on November 9 and confirmed data was taken on November 12. It notified HHS and affected people in early 2022.
Sources checked: securityweek.com, businesswire.com, ocrportal.hhs.gov
Last verified against the official page:
What was exposed
According to the notice and HHS's summary, the data included names, addresses, dates of birth, Social Security numbers, claims information, diagnoses, lab results, medications and other treatment information. Because MRIoA works for health plans, you may have received the letter from your plan.
Why you may not know the company
MRIoA is a clinical review vendor: it works for health plans, not directly for patients. Press coverage and plan websites such as Ambetter's posted notices about the incident. That's why the name on the envelope may look unfamiliar.
The response
Per HHS, MRIoA added administrative and technical safeguards and offered complimentary credit monitoring.
What this means for you
Social Security numbers and dates of birth call for a credit freeze. Medical details call for a close look at your insurance statements.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Social Security numbers and dates of birth are enough to open accounts in your name. A credit freeze is free, and you place it separately at Equifax, Experian and TransUnion. The FTC explains how: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- 2
Read your insurance statements
Check explanation of benefits statements and medical bills for care you didn't receive. If something looks wrong, call your insurer and the provider.
- 3
Expect phishing that mentions the breach
Calls, texts and emails that quote real details about you are more convincing. Don't click links or give out information; contact the organization using a number from its own website. The FTC's breach guide is at https://www.identitytheft.gov/databreach
- 4
Check whether your details are in other breaches
Run a free Serus scan to see whether your email or phone number shows up in this and other breaches. Serus can't remove breach data, but it alerts you when your details appear in new ones.
Official filings
- U.S. Department of Health and Human Services , filed 7 Jan 2022 : 134,571 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the MRIoA breach?
MRIoA and the health plans it works for sent notice letters. If you got one, you were affected. If you think you should have, contact your health plan.
What was exposed?
Names, addresses, dates of birth, Social Security numbers, claims information, diagnoses, lab results, medications and other treatment information.
Should I freeze my credit?
The FTC says a credit freeze is free and blocks most new accounts in your name. Social Security numbers were involved, so it's worth doing.
Sources
- securityweek.com/mrioa-discloses-data-breach-affecting-134000-people/
- businesswire.com/news/home/20220107005027/en/Medical-Review-Institute-of-America-Notifies-Patients-of-Data-Breach
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
