Discovery Practice Management, Inc.

Discovery Practice Management, Inc., a California-based business associate, reported to HHS on 2021-06-05 a ransomware attack affecting the PHI of 12,859 individuals. Breached information was located in Email systems. Exposed data included names, addresses, dates of birth, Social Security numbers, driver's license numbers, medical record numbers, diagnoses, prescription information, and health insurance and financial information. The BA notified HHS, affected individuals, and the media, and provided substitute notice. Mitigation included additional administrative and technical safeguards and staff retraining.

Affected (this filing): 12,859

Discovery Practice Management, Inc. reported unauthorized access to staff email accounts between June 22-26, 2020, discovered on July 31, 2020. The breach potentially exposed patient and employee PII, including names, SSNs, DOBs, medical records, and financial data. Discovery engaged forensic investigators, secured accounts, and offered one year of credit monitoring to affected individuals.