CBLPath

CBLPath Inc. notified Montana residents of a data security incident involving its vendor, American Medical Collection Agency (AMCA). AMCA's database containing patient information was accessed. Data involved included names, addresses, DOBs, and treatment details. CBLPath engaged cybersecurity experts and terminated the vendor relationship.

CBLPath Inc. notified Delaware residents of a data security incident involving its vendor, Retrieval Masters Creditors Bureau d/b/a American Medical Collection Agency (AMCA). On May 15, 2019, AMCA experienced unauthorized access to a database containing patient information belonging to CBLPath. The incident involved AMCA's website payment page and database. Affected data included names, addresses, phone numbers, dates of birth, dates of service, balance information, and treatment provider information. CBLPath stopped using AMCA and engaged cybersecurity experts.

CBLPath, Inc. reported to HHS on 2019-07-15 a Unauthorized Access/Disclosure affecting 141,956 individuals. Breached information located on Network Server. The breach involved its business associate, Retrieval-Masters Creditors Bureau, Inc., which suffered a cyber-attack exposing ePHI including names, addresses, phone numbers, dates of service, birthdates, clinical information, and financial information. CBLPath terminated its relationship with the BA and implemented additional administrative safeguards.

CBLPath, Inc. notified patients of a data security incident involving its vendor, Retrieval Masters Creditors Bureau d/b/a American Medical Collection Agency (AMCA). The incident involved unauthorized access to AMCA's database and payment page, potentially exposing patient names, addresses, phone numbers, dates of birth, service dates, balance information, and treatment provider information. The breach occurred between August 1, 2018, and March 30, 2019. CBLPath was notified on May 15, 2019, and immediately ceased using AMCA for collections. Cyber security experts were engaged to assist in the investigation.

CBLPATH, INC filed a data-breach notice with the Illinois Attorney General during 2019 (case 2019-262). The register records the breach as discovered on April 21, 2019. Additional entities named: RETRIEVAL MASTERS CREDITORS BUREAU DBA. AMERICAN MEDICAL COLLECTION AGENCY. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.