Watson Clinic data breach: what happened and what to do

What happened

Watson Clinic is a multispecialty medical group in Lakeland, Florida. In its notice, the clinic said an unauthorized third party gained access to a limited portion of its network starting on January 26, 2024, and that it discovered the intrusion on February 6, 2024. It reported the incident to HHS in May 2024 as affecting 280,278 people.

The clinic said it could not confirm whether files were actually viewed or taken for most people, but it notified them out of caution. Its updated notice, dated August 26, 2024, said it had no evidence that anyone had used the information fraudulently.

What was exposed

Watson Clinic's updated notice says the potentially exposed information included names combined with some mix of addresses, birthdates, Social Security or similar government numbers, driver's license numbers and financial account information. Limited medical details such as diagnoses, treatments or medical record numbers may also have been involved. Which items applied depended on the person.

HIPAA Journal reports that some medical images were also taken and that some of them were later posted online. That detail comes from news coverage of the case and the later class action, not from the clinic's notice.

With a Social Security number and birth date, criminals can open credit in your name. Medical details give scammers material for convincing calls from someone claiming to be your clinic or insurer.

The clinic's response

Watson Clinic told people to review their account statements, consider fraud alerts or a credit freeze, and report anything suspicious. According to HIPAA Journal, it later agreed to pay $10 million to settle a class action lawsuit over the breach.