Don’t turn a blind eye to security, otherwise the next data breach could blindside you. The Southeast Eye Institute, PA sees that clearly know, following an incident in which an unauthorized attacker accessed patient files that a third-party vendor once managed.

According to the Office of Civil Rights (OCR), the hack compromised the personal information of around 87,314 patients, including names, phone numbers, insurance information, and Social Security numbers. HealthIT Security notes that the hackers could have accessed the information as early as January 2015, but was not noticed until near the end of March 2016.

The information was accessed through Bizmatics Inc., a third-party offsite vendor that ran Southeast Eye Institute’s practice management software. While there’s no confirmation on what exact files were exposed, the institute notes that any patients who had an appointment on or before November 16, 2015 are at risk.

However, Bizmatics did divide the patient information into several individual files, so as to improve security and keep matching information separate. So even if an attacker accessed the data, there’s no knowing if they managed to connect the relevant pieces together.

This is not the first time Bizmatics has suffered a data breach either. It recently had to notify the Pain Treatment Centers of America after a PHI breach, and the Complete Family Foot Care in Nebraska after another outside party accessed its information, among other similar breaches.

While Southeast Eye Institute is no longer working with the vendor, Bizmatics did contact the FBI and hire a cybersecurity firm to help improve its data security. Considering the multiple data breaches it’s suffered from, this is a vital role, but sadly late. Southeast Eye Institute has also alerted those affected, and is offering a year of free credit monitoring services.

photo credit: recombiner via photopin cc