Reventics reventics.com Reventics data breach: what happened and what to do
Reventics, a medical billing and revenue cycle company, reported a December 2022 breach to HHS that affected 4,212,823 people. Its notice lists names, dates of birth, Social Security numbers, financial details and clinical information. Most patients had never heard of the company.
View all 13,177 breaches- Breach date
- 15 Dec 2022
- Made public
- 10 Feb 2023
- Affected
- 4,212,823
- Data exposed
- Names, Dates of birth, Social security numbers, Financial information, Health insurance information, Treatment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Reventics is a revenue cycle management company: hospitals and physician groups hire it to handle billing and collections. That means it holds patient records for people who never dealt with it directly.
According to the breach report filed with the U.S. Department of Health and Human Services (HHS), Reventics found a breach incident in December 2022. HHS lists the date as December 15, 2022. The company reported it to HHS as a business associate, which is the legal term for a vendor that handles health data for a hospital or clinic.
The count changed. HIPAA Journal reports that the first filing covered up to 250,918 people, and Reventics later amended it to 4,212,823 after it became clear more data was involved. The higher figure is what HHS now shows.
Sources checked: hipaajournal.com, databreaches.net, ocrportal.hhs.gov
Last verified against the official page:
What was exposed
Reventics' notice, as summarized by DataBreaches.net, lists first and last name, date of birth, Social Security number, financial information, the healthcare provider's name and address, health plan name and clinical data. HHS describes the data as demographic, financial and treatment information.
A date of birth plus a Social Security number is what someone needs to apply for credit or file a tax return in your name. Clinical details and your provider's name give a scammer material for a convincing call posing as a clinic or insurer.
What the company did
Reventics notified HHS and the affected healthcare providers, and said it put administrative, technical and security safeguards in place. If you were affected, you should get a letter from Reventics or from the provider whose records it held.
What to do if you were in it
- 1
Find out whether you were affected
Look for a letter from Reventics or from a hospital or physician group you've used, usually the one that handled your billing. If you can't find one, call that provider's billing office using the number on its official website.
- 2
Freeze your credit at all three bureaus
A Social Security number was involved, so a credit freeze is the strongest step. The FTC says it's free and you place it separately at Equifax, Experian and TransUnion. If you'd rather not freeze, a fraud alert is a lighter option and lasts one year.
- 3
Take the free credit monitoring if it's offered
If your notice letter includes an enrollment code, use it before the deadline printed on the letter. The FTC recommends accepting free credit monitoring after a breach.
- 4
Watch for scams that mention the breach
Criminals use real breach details to sound legitimate. Don't act on a call, text or email about your account or bill, even if it knows your name. Contact the organization using a number from your letter or its official website.
- 5
Report identity theft if it happens
If someone opens an account in your name, report it at IdentityTheft.gov and follow the recovery plan the FTC builds for you.
- 6
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. It shows breaches that include your email or phone number and what to do about each one. Serus can't remove data from a breach, but it alerts you when new exposures appear.
Official filings
- U.S. Department of Health and Human Services , filed 10 Feb 2023 : 4,212,823 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Reventics data breach?
Reventics reported 4,212,823 affected people to HHS. Affected people should receive a letter from Reventics or from their healthcare provider. If you've received care from a provider that used Reventics for billing, ask its billing office.
What data was exposed in the Reventics breach?
The notice lists name, date of birth, Social Security number, financial information, provider name and address, health plan name and clinical data.
Why did a company I never heard of have my data?
Billing vendors work for hospitals and clinics, so they hold patient records without a direct relationship with the patient.
Should I freeze my credit after the Reventics breach?
If your Social Security number was included, yes. The [FTC](https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts) says freezing is free and you do it at each of the three bureaus.
Sources
- hipaajournal.com/rise-interactive-media-analytics-dothouse-health-and-reventics-hacked/
- databreaches.net/reventics-notifying-patients-of-ransomware-incident/
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
