Luque Chiropractic, Inc.

Luque Chiropractic, Inc. disclosed a data security incident involving a misconfigured Amazon S3 storage account managed by its billing software provider. The vulnerability existed from May 2016 to September 11, 2016, and was discovered on September 18, 2016, when the provider notified Luque that a security researcher had accessed and downloaded data. Affected data included protected health information (PHI), patient names, addresses, diagnoses, dates of birth, treatment details, and Social Security numbers. Luque secured the account, launched an investigation, and offered credit monitoring services to affected patients. No fraud was reported.

Luque Chiropractic, Inc. reported to HHS on 2016-11-17 a Unauthorized Access/Disclosure affecting 1341 individuals. Breached information located on Network Server. A business associate (EMR4all Inc.) notified the covered entity that its Amazon S3 storage account was subject to unauthorized access, exposing patient PHI including names, DOB, SSNs, and diagnoses.