Texas Regional Asthma, Allergy & Immunology Center, a Southlake and Fort Worth, Texas allergy and immunology practice, notified patients that a security incident at one of its technology vendors may have exposed personal or health information. The practice says it has no indication that any information has actually been misused, but it is notifying patients out of an abundance of caution and offering free credit monitoring services.
Texas Regional Asthma, Allergy & Immunology Center’s Data Breach Investigation
According to the notification letter sent to affected patients, the breach did not originate inside Texas Regional Asthma, Allergy & Immunology Center’s own systems. Instead, the practice relies on Rosch Visionary Systems, Inc., a software provider used by allergy medical practices across the country, to help run day-to-day operations. Rosch Visionary Systems detected a compromise affecting a portion of its own network, and that compromise extended to information tied to the practices, including Texas Regional Asthma, Allergy & Immunology Center, that rely on its software.
The notice sent to patients does not disclose the specific technical cause of the intrusion, how the unauthorized access was first detected, or how many patients nationwide were affected across all of Rosch’s medical-practice clients. This kind of vendor-side breach has become increasingly common in the healthcare sector, where small and mid-sized medical practices often outsource practice-management and billing software to third-party technology companies rather than building and securing those systems in house. When one vendor serves dozens or hundreds of medical practices from a shared platform, a single compromise at the vendor level can potentially expose patient data belonging to every practice that relies on that vendor, even though none of those practices experienced a breach of their own internal systems.
Healthcare data breaches involving third-party vendors have drawn increasing regulatory attention in recent years, in part because patients often have no direct relationship with, or knowledge of, the software vendor whose systems were actually compromised. Patients typically only learn a vendor was involved when their own doctor’s office sends a notification letter, as happened here. Because the letter identifies the cause as a compromise of a portion of Rosch’s environment, without further detail, patients have no way to independently confirm the scope of the incident beyond what the practice and its vendor have chosen to disclose.
The type of information exposed in a healthcare vendor breach can vary widely depending on what data the practice-management software stores, ranging from basic contact information to more sensitive health and insurance details. Individuals whose personal or health information is exposed in this kind of incident can face a heightened risk of follow-up phishing attempts, since bad actors sometimes use information from healthcare breaches to craft convincing fake messages claiming to be from a patient’s own doctor’s office, insurer, or a credit monitoring provider. Remaining cautious about unsolicited calls, texts, or emails referencing this incident is a reasonable precaution even for patients who have not noticed any suspicious activity yet.
Vendor-driven breaches like this one also tend to move more slowly through the notification pipeline than a breach at a company a patient directly deals with. A practice like Texas Regional Asthma, Allergy & Immunology Center depends on its vendor to first detect an intrusion, investigate its scope, determine which client practices and patients were potentially affected, and only then notify each affected practice, which in turn notifies its own patients. That multi-step chain means patients are often learning about an incident weeks or months after the vendor’s systems were first compromised, and it also means the practice itself may have limited independent ability to confirm details beyond what its vendor discloses.
Regulators and privacy advocates have increasingly pushed for stronger vendor-oversight requirements in healthcare specifically because of this dynamic, since patients have no direct contractual relationship with, and generally cannot vet the security practices of, every software vendor that touches their medical information behind the scenes. Until stronger standards are broadly adopted, patients are largely left to rely on the notification and remediation steps offered after the fact, such as the credit monitoring service described below, rather than any ability to have prevented the incident themselves.
When Did This Breach Occur?
Texas Regional Asthma, Allergy & Immunology Center’s notification letter does not include specific dates for when the compromise at Rosch Visionary Systems occurred, when it was detected, or when the practice itself was notified. The letter states only that Rosch has detected a compromise to a portion of its network, without further timeline detail.
What Information Was Breached?
The notification letter states that the incident could have affected personal or health information, without listing a specific set of data elements such as names, Social Security numbers, or account numbers. Texas Regional Asthma, Allergy & Immunology Center has not publicly disclosed a more detailed breakdown of exactly what categories of patient information were involved.
What You Can Do
Texas Regional Asthma, Allergy & Immunology Center is offering affected patients free credit monitoring services for twenty-four months through a third-party vendor named in the notification letter. Patients who received a letter should consider the following steps:
- Enroll in the offered credit monitoring service before the enrollment deadline listed in your letter
- Regularly review account and insurance statements for any unfamiliar activity
- Consider placing a fraud alert or security freeze with the three major credit bureaus
- Order a free copy of your credit report annually at annualcreditreport.com to check for unfamiliar accounts
- Remain alert for phishing calls, texts, or emails referencing this incident or your medical provider
File a Data Breach Lawsuit Against Texas Regional Asthma, Allergy & Immunology Center
Patients whose personal or health information may have been exposed through this vendor-related incident may have legal options worth exploring. An attorney experienced in data breach litigation can help evaluate whether a patient has grounds to pursue compensation for the exposure of their information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
