Iowa Digestive Disease Center, a Clive, Iowa-based gastroenterology practice, notified patients that a third-party vendor experienced a data security incident that may have exposed some of their protected health information. The practice is offering affected individuals complimentary credit monitoring and identity restoration services as a precaution.
Companies and the vendors they rely on to store and manage patient records are entrusted with some of the most sensitive information a person has, and that responsibility does not end once the data leaves the practice’s own systems.
Iowa Digestive Disease Center’s Data Breach Investigation
According to a notification letter sent to affected individuals, Iowa Digestive Disease Center, P.C. (IDDC) uses Aesto, LLC, a third-party company that provides healthcare data migration and archiving services, to help manage certain patient records. Aesto notified IDDC of a data security incident affecting some of the protected health information Aesto maintains on the practice’s behalf. The letter, dated September 10, 2026, does not specify when the underlying incident occurred, when it was first detected, or the specific cause, information that is often withheld from an initial notification letter while an investigation is still ongoing or while a company works with counsel to determine what can be disclosed under applicable law.
This incident highlights a pattern that has become increasingly common in the healthcare sector: exposure through a third-party vendor rather than a direct breach of a medical practice’s own network. Many healthcare providers, including small and mid-sized specialty practices like IDDC, rely on outside vendors for services such as data migration, archiving, billing, and records management, because maintaining that infrastructure in-house is often impractical. That reliance means a patient’s sensitive health information can pass through, and be stored by, systems the treating provider does not directly control, and a vulnerability or intrusion at the vendor level can expose patient data even when the practice’s own systems were never compromised.
Healthcare organizations remain one of the most frequently targeted sectors for data security incidents, in large part because medical records combine several categories of information, identifying details, insurance and billing data, and clinical history, that can be valuable to bad actors and difficult for an individual to change once exposed, unlike a password or a credit card number. Even when a notification letter does not specify exactly which data elements were involved, as is the case here, an incident affecting protected health information carries meaningful risk because it can potentially be used to commit medical identity theft, file fraudulent insurance claims, or support other forms of fraud that are harder for victims to detect and unwind than ordinary financial account fraud.
Notification letters like this one are typically required under state data breach notification statutes as well as, for healthcare-related incidents, federal requirements under the Health Insurance Portability and Accountability Act (HIPAA). These laws generally require organizations to notify affected individuals within a defined window after discovering that protected health information may have been compromised, though the specific triggering date and the exact scope of what must be disclosed can vary depending on the type of incident and the state or states where affected individuals reside. The absence of a specific incident date or cause in a letter like this one does not necessarily mean the company is withholding information improperly, but affected individuals are left with an incomplete picture of what happened, which is one reason it is worth taking the offered credit monitoring and identity protection services seriously.
Incidents involving third-party vendors also raise questions about oversight, specifically, what due diligence a healthcare provider conducted before entrusting a vendor with patient data, and what contractual and technical safeguards were in place to limit the vendor’s exposure to that data or to detect an intrusion quickly once it occurred. Patients generally have no visibility into these vendor relationships until a breach notification arrives, which can make an incident like this one feel especially unsettling, since the practice a patient trusted directly may not be the party whose systems were actually compromised.
Following any healthcare-related data security notification, affected individuals should also be alert to an increase in phishing attempts that reference the incident by name in an effort to appear credible while trying to extract additional personal or financial information. Individuals who received a letter from Iowa Digestive Disease Center regarding this incident should treat unsolicited follow-up communications with caution and verify their authenticity independently rather than responding directly.
When Did This Breach Occur?
Iowa Digestive Disease Center’s notification letter, dated September 10, 2026, does not disclose a specific date for when the underlying data security incident occurred or when Aesto, LLC first detected it internally. The letter states only that Aesto notified IDDC of a data security incident affecting protected health information the vendor maintains on the practice’s behalf, without providing a discovery or breach timeline.
What Information Was Breached?
The notification letter confirms that the incident involved some of the protected health information Aesto maintains for Iowa Digestive Disease Center, but it does not specify which individual data elements, such as names, dates of birth, medical record numbers, or treatment information, were actually involved for any given patient. IDDC has not publicly disclosed a more detailed breakdown of the specific information types affected.
What You Can Do
Iowa Digestive Disease Center, through Aesto, is offering affected individuals complimentary access to Experian IdentityWorks for 24 months, including credit monitoring and identity restoration support. Affected individuals should consider the following steps:
- Enroll in the complimentary Experian IdentityWorks membership using the activation code provided in your letter before the enrollment deadline
- Regularly review your credit reports and account statements for unfamiliar activity
- Consider placing a fraud alert or security freeze with the three major credit bureaus
- Order a free copy of your credit report annually at annualcreditreport.com
- Contact the dedicated response line provided in your letter with any questions about this incident
File a Data Breach Lawsuit Against Iowa Digestive Disease Center
Patients whose protected health information may have been exposed in this incident may have legal options worth exploring. An attorney experienced in data breach litigation can help evaluate whether affected individuals have grounds to pursue compensation.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
