Dental Practice Pays State in Alleged Data Breach ‘Cover Up’

An Indiana dental practice agreed to pay the state $350,000 and implement a long list of data security improvements following an alleged “cover up” of a 2020 ransomware data breach that came to light when regulators investigated a patient complaint about unfulfilled requests for dental X-rays.

See Also: 2023 Ransomware Preparedness: Key Findings, Readiness and Mitigation

A federal lawsuit filed on Dec. 23, 2024, by Indiana Attorney General Todd Rokita alleges that Westend Dental, which operates in six locations in Indianapolis and Lafayette, was aware of the ransomware attack occurring at one of its office in October 2020 – but at no time conducted a forensics investigation into the incident nor notified individuals whose protected health information was affected. Westend allegedly told a patient requesting X-ray copies that it no longer had the records “because someone ‘hacked’ into their systems,” the state’s lawsuit states.

Indiana’s lawsuit alleges that Westend violated HIPAA and state data security and breach laws.

The attorney general further alleged Westend attempted to “cover up” the October 2022 ransomware data breach.

“Although Westend Dental was legally required to report the data breach directly to the Office of Attorney General, the OAG discovered the data breach through its investigation of a consumer complaint made by a Westend Dental patient,” the state’s lawsuit alleged.

Westend finally reported the data breach in October 2022, two years after the incident, stating the data breach affected fewer than 500 individuals, and falsely stating that the incident did not involve an intrusion.

Rather, Westend falsely claimed data was lost through a formatting mistake involving a server hard drive – despite the practice being aware its files had been encrypted with malware in the incident, and having received a ransom demand from cybercriminal group MedusaLocker, the state alleges.

Under the proposed consent order, Westend will pay the financial settlement to the state, implement a lengthy list of data security measures and overall HIPAA compliance, to notify individuals potentially affected by the breach.

But because Westend did not conduct a forensics investigation, there may be no clear estimate for the number of people affected. As a result, Westend must notify all its patients as of November 2023.

In addition to the data breach, Indiana’s attorney general office alleges in its lawsuit that Westend also violated HIPAA privacy rules in the practice’s response to online reviews and in other social media posts.

That included Westend posting patients’ protected health information and photos – including that of minors – without their or their parents’ consent.

Federal regulators in recent years have also taken several enforcement actions against medical centers – including dental practices – for alleged HIPAA violations involving social media posts containing patient PHI.

In 2022, the U.S. Department of Health and Human Services fined a Los Angeles dental practice $23,000 after federal investigators found that it “habitually” responded to criticism on Yelp by posting patient names and detailed information about patient visits and insurance (see: Dental Practice Hit with HIPAA Fine for Posting PHI on Yelp).

Neither the Indiana attorney general office nor Westend Dental immediately responded to a request for comment on their case.