Hematology and Oncology Consultants has begun notifying patients that their personal and medical information may have been exposed as a result of a data security incident at Unlimited Technology Systems, a third-party practice management software provider the practice relies on to manage patient records. The notice indicates that names, Social Security numbers, medical information, and health insurance information were involved.
Medical practices that rely on outside vendors to manage sensitive patient records still bear a responsibility to ensure those vendors adequately protect the information entrusted to them, and when a third-party incident exposes patient data, the practice has an obligation to notify those affected promptly and clearly.
Hematology and Oncology Consultants’ Data Breach Investigation
According to a notice posted by Hematology and Oncology Consultants, the practice learned that patient information had been exposed through a data security incident at Unlimited Technology Systems, the third-party technology provider used to support the practice’s operations. Vendor-related breaches like this one have become increasingly common as healthcare providers, law firms, and other organizations rely on outside companies to manage records, billing, scheduling, and other sensitive functions. When one of these vendors is compromised, every client organization that shares data with that vendor can be affected, sometimes resulting in a single vendor incident triggering breach notifications from dozens of separate companies.
The information reportedly involved in this incident includes patient names, Social Security numbers, medical information, and health insurance information. This combination of data is considered especially sensitive because it can be used not just for traditional financial identity theft, but also for medical identity theft, in which a criminal uses a victim’s identity and insurance information to obtain medical services, prescription medications, or durable medical equipment, or to submit fraudulent insurance claims. Medical identity theft can be more difficult to detect and unwind than standard financial fraud, since it may not show up on a routine credit report and can instead surface as inaccurate information in a victim’s own medical records.
Because Social Security numbers were also involved, affected individuals face the same risks associated with any major data exposure, including the potential for new fraudulent accounts, tax fraud, and long-term identity theft that can persist for years after the initial incident. Healthcare organizations remain one of the most heavily targeted sectors for data breaches precisely because the combination of medical and financial data they hold is so valuable to criminals, and third-party vendors serving the healthcare industry have increasingly become a preferred target since compromising one vendor can expose the patients of many different providers at once.
Hematology and Oncology Consultants has stated that affected individuals were notified directly. Patients who receive such a notice should treat it seriously, since it confirms that their specific information was involved in a confirmed security incident rather than a general, unconfirmed risk.
When Did This Breach Occur?
Hematology and Oncology Consultants has not publicly disclosed the specific date the underlying security incident at Unlimited Technology Systems occurred or when it was discovered. The practice began notifying affected patients directly once it learned that their information had been involved.
What Information Was Breached?
Based on Hematology and Oncology Consultants’ notice, the information exposed in this incident includes patient names, Social Security numbers, medical information, and health insurance information.
What You Can Do
If you received a data breach notification letter from Hematology and Oncology Consultants, consider taking the following steps:
- Monitor your credit reports and financial accounts closely for any signs of suspicious activity
- Consider placing a fraud alert or credit freeze with all three major credit bureaus
- Watch for phishing emails, texts, or phone calls referencing this breach or your medical history
- Review your medical bills and insurance statements for services you do not recognize, which can indicate medical identity theft
- Keep your data breach notification letter for your records, as it may be needed if you pursue legal action
File a Data Breach Lawsuit Against Hematology and Oncology Consultants
If you received notice that your personal or medical information was exposed in this breach, you may have legal options available to you. Healthcare providers and the vendors they rely on have a legal obligation to implement reasonable safeguards to protect patient data, and when that data is compromised, affected individuals may be entitled to compensation.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
