Silverberg Surgical and Medical Group

On September 10, 2013, a document scanning device at Silverberg Surgical and Medical Group inadvertently exposed patient health records to the Internet. Exposed data included names, addresses, dates of birth, medical information, SSNs, and more. The breach was discovered on August 28, 2015—nearly two years later. The device was taken offline, a forensic firm was engaged, and the FBI was notified. Kroll identity monitoring was offered to affected individuals.

Silverberg Surgical and Medical Group (CA) reported to HHS on 2015-09-25 an Unauthorized Access/Disclosure breach affecting 857 individuals. A business associate misconfigured its document scanning device, allowing scanned records to be accessible via the Internet. PHI exposed included names, addresses, dates of birth, phone numbers, email addresses, medical information, medical record numbers, health plan information, SSNs, state license numbers, and full face photographic images. The CE notified HHS, affected individuals, and media, and provided credit monitoring, identity theft consultation, and a dedicated call center.