Vendor Scam Results in Data Breach for Clinic

Raleigh Orthopaedic Clinic in North Carolina is notifying approximately 17,300 patients of a breach of their protected health information after the clinic apparently was the victim of a scam.

The clinic contracted with a vendor to transfer X-ray films into an electronic format, which the vendor never delivered. “It appears that the X-ray films were sold to a recycling company in Ohio that harvested the silver from the films,” clinic’s public notice explains. “Raleigh Ortho believes the films were ultimately destroyed.”

Based on its investigation, the clinic believes the only individually identifiable information on the films was the patients’ name and date of birth, but has no way of knowing whether or how the information may have been used.

The clinic is recommending that patients check their account statements and monitor their credit reports. The privacy officer did not return a phone query on whether the clinic is offering affected patients paid credit and/or identity protection services.