Specialty Networks breach exposed data on more than 411,000 patients

Specialty Networks, Inc., a Chattanooga, Tennessee company that supplies radiology information systems, digital transcription and enterprise practice management services to medical providers, began notifying patients on August 15, 2024 about a data security incident that had occurred eight months earlier.

The company said it detected unusual activity on its network on December 18, 2023. A forensic investigation determined that an unauthorized party had access to its environment from about December 11 until the activity was found on December 18, and that files were copied during that window. Specialty Networks said it did not establish that the files contained protected health information until May 31, 2024, and began coordinating notifications with the healthcare providers whose patients were involved around June 24, 2024.

The exposed information varied by individual and could include names, dates of birth, driver's license numbers, Social Security numbers, medical record numbers, diagnoses, medications, treatment and condition details, and health insurance information. The HIPAA Journal reported that 411,037 current and former patients were affected.

Specialty Networks said it engaged a digital forensics firm, secured its network and reviewed the affected data before issuing letters. Affected individuals were offered complimentary credit monitoring and identity theft protection through IDX, and the company set up a dedicated toll-free line for enquiries. Because the company acts as a service provider to medical practices, the notifications were coordinated with each affected provider rather than issued by Specialty Networks alone.