Orthopedic Practice Pays $500K Settlement to NYS in Hack

An upstate New York orthopedic practice will pay state regulators a $500,000 settlement and implement stronger security practices following a 2023 hacking incident involving the theft of 650,000 individuals’ sensitive information.

See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective

The enforcement action against OrthopedicsNY, more widely known as OrthoNY, was disclosed at the end of December by New York State’s attorney general Letitia James.

OrthoNY operates several clinics and surgery centers across the New York State’s Capital Region around Albany.

An investigation by the attorney general concluded that hackers were able to steal OrthoNY’s data “because the healthcare practice did not properly protect its systems,” the state said.

The investigation determined that in 2023, attackers gained remote access to OrthoNY’s network using compromised login information. “The attackers then downloaded unencrypted files containing sensitive private personal and health care information of approximately 656,000 individuals, including the Social Security numbers, driver’s license numbers, or passport numbers for approximately 110,000 individuals,” the state said.

“Patients entrust their healthcare providers with their personal information, and providers must honor that trust by ensuring their systems are secure,” James said in a statement. “OrthopedicsNY failed to do its due diligence to protect patients’ private information,” she said.

In addition to paying the half-million-dollar settlement, OrthoNY has agreed to implement a “comprehensive” program to bolster its data security.

Specifically:

• Establishing and implementing policies and procedures that appropriately limit access to patient and employee data;
• Implementing multifactor authentication for remote access into the practice’s network;
• Encrypting patient and employee data that the practice collects, stores, transmits, and maintains;
• Deploying and maintaining a system to monitor networks and systems for anomalous activity;
• Conducting annual security risk assessments.

Cybercriminal gang INC Ransom in January 2024 claimed credit for OrthoNY incident, according to ransomware monitoring website Ransomware.live.

OrthoNY did not immediately respond to Information Security Media Group’s request for comment on the settlement and for additional details about the cyber incident.

OrthopedicsNY also reported the HIPAA breach to federal regulators in February 2024 as a hacking incident involving a network server and affecting 656,086 individuals.