The Centers for Advanced Orthopaedics

The Centers for Advanced Orthopaedics (Maryland healthcare provider) reported a ransomware incident affecting PHI of 21,162 individuals. PHI included names, dates of birth, SSNs, driver's license numbers, passport numbers, diagnoses, financial information, and other treatment information. The CE notified HHS, affected individuals, and the media, posted substitute notice, implemented additional safeguards, and retrained all staff.

The Centers for Advanced Orthopaedics (MD) reported to HHS OCR on 2021-03-25 a Hacking/IT Incident affecting 125,291 individuals. Multiple employees were victims of an email phishing scheme that exposed PHI including names, dates of birth, Social Security numbers, drivers' license numbers, passport numbers, diagnoses, and financial and other treatment information. Breached information located in Email. The CE notified HHS, affected individuals, and media, implemented additional safeguards, and retrained staff on identifying fraudulent emails. No business associate was involved.

The Centers for Advanced Orthopaedics, LLC notified patients of unauthorized access to employee email accounts between Oct 2019 and Sep 2020. The breach, discovered Sep 17, 2020, exposed PHI including names. The organization engaged forensic experts, notified the FBI and HHS, and offered two years of credit monitoring.

CENTERS FOR ADVANCED ORTHOPAEDICS filed a data-breach notice with the Illinois Attorney General during 2021 (case 21-148). The register records the breach as discovered on September 17, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.