Healthcare Data Breach Report: Dr. Michael Kaplan DO PC DBA Long Island Weight Loss Institute

Incident Overview

Dr. Michael Kaplan DO PC, operating as Long Island Weight Loss Institute in New York, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the U.S. Department of Health and Human Services on November 20, 2025, affecting 3,426 individuals. This incident represents a hacking or IT-related compromise of the organization's computer systems, resulting in potential exposure of protected health information (PHI) maintained on networked servers. The breach occurred at the network server level, indicating that attackers gained unauthorized access to centralized data storage systems rather than isolated workstations or portable devices.

Discovery and Response Timeline

While specific details regarding the initial discovery method are not provided in the breach notification submission, the organization's response included conducting a formal investigation into the scope and nature of the unauthorized access. The entity completed its investigation and submitted notification to HHS within the required timeframe, demonstrating compliance with HIPAA Breach Notification Rule requirements. The investigation process typically involves forensic analysis of network logs, access controls, and system activity to determine what data was accessed, when the breach occurred, and how long unauthorized access persisted. The organization notified affected individuals as required under 45 CFR §164.404, which mandates notification without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI.

Technical Breach Details

Network server breaches typically occur through one or more of several common attack vectors: exploitation of unpatched software vulnerabilities, weak or compromised credentials, phishing attacks targeting staff with administrative access, or misconfigured security controls. The fact that this breach occurred at the network server level—rather than affecting individual workstations or portable devices—suggests that attackers gained access to centralized systems where patient records are stored and processed. This type of breach is particularly concerning because network servers typically contain comprehensive patient databases with consolidated PHI rather than isolated records. The breach may have resulted from external threat actors exploiting internet-facing systems, insider threats with legitimate system access, or a combination of factors. Network server compromises often go undetected for extended periods, as attackers may maintain persistent access while exfiltrating data gradually.

Organizational Context

Dr. Michael Kaplan DO PC operates Long Island Weight Loss Institute, a specialized medical practice focused on weight management and obesity treatment services. The organization is a single-provider or small group practice based in New York, serving patients in the Long Island region and potentially surrounding areas. Weight loss clinics typically maintain detailed patient records including medical histories, treatment plans, medication information, and potentially sensitive lifestyle and health data. As a medical practice, the organization is a covered entity under HIPAA and is required to maintain appropriate administrative, physical, and technical safeguards to protect patient PHI. The breach indicates that the organization's IT infrastructure and security controls were insufficient to prevent unauthorized access to its network servers.

Patient Impact and Affected Population

Approximately 3,426 individuals had their protected health information potentially exposed in this breach. This population includes current and former patients of Long Island Weight Loss Institute who had records stored on the compromised network servers. The affected individuals likely include patients who sought weight management services, bariatric consultations, or related medical treatments at the facility. Each affected individual was required to receive breach notification in writing, informing them of the incident, the types of information potentially exposed, steps the organization is taking to address the breach, and recommended actions patients should take to protect themselves. The notification must include information about credit monitoring services if financial information was exposed, as required under HIPAA regulations.

Data Exposure and HIPAA Implications

Network server breaches at medical practices typically expose multiple categories of PHI, potentially including patient names, dates of birth, medical record numbers, Social Security numbers, insurance information, medical histories, diagnoses, treatment records, medication lists, and clinical notes. In the context of a weight loss clinic, additional sensitive information may include detailed health assessments, weight and body composition measurements, dietary information, behavioral health data, and potentially mental health or psychological evaluations related to eating disorders or weight management. The exposure of such comprehensive health information creates significant privacy risks and potential for identity theft or medical fraud. Under HIPAA's Breach Notification Rule, any breach of unsecured PHI affecting more than 500 residents of a state must also be reported to prominent media outlets in that state, which may have occurred in this case given the number of affected individuals. The organization must also report the breach to HHS, which maintains a public breach notification log accessible to consumers.