East River Medical Imaging Data Breach Report

Incident Overview

East River Medical Imaging, PC, a diagnostic imaging provider based in New York, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the U.S. Department of Health and Human Services on November 22, 2023, and affected approximately 605,809 individuals. This incident represents one of the larger healthcare data breaches reported in 2023, exposing sensitive patient health information and personal identifiers to unauthorized parties through a hacking or IT security incident targeting the organization's networked systems.

Discovery and Response Timeline

The specific discovery date and investigation timeline were not detailed in the breach submission, though the November 22, 2023 submission date indicates the breach was reported within the required 60-day notification window mandated by HIPAA Breach Notification Rule. East River Medical Imaging likely initiated a forensic investigation following detection of the unauthorized access, which typically involves engaging cybersecurity experts to determine the scope of the breach, identify affected individuals, and implement remediation measures. The organization would have been required to notify affected individuals, the media (given the size of the breach), and HHS as part of their HIPAA compliance obligations. The fact that no Business Associate was involved suggests the breach occurred directly within East River Medical Imaging's own systems rather than through a third-party vendor or service provider.

Technical Details of the Breach

The breach occurred at the network server level, which typically indicates a compromise of centralized data storage systems rather than isolated workstations or portable devices. Network server breaches of this magnitude usually result from one or more of the following vectors: exploitation of unpatched software vulnerabilities, weak authentication credentials, inadequate firewall configurations, successful phishing campaigns targeting employee credentials, or advanced persistent threats (APTs) that maintain long-term access to systems. The scale of the breach—affecting over 600,000 individuals—suggests the attacker(s) gained access to core database systems containing comprehensive patient records rather than isolated data repositories. This type of incident typically indicates a significant gap in the organization's cybersecurity posture, potentially including insufficient network segmentation, inadequate intrusion detection systems, or delayed patch management protocols.

Organizational Context

East River Medical Imaging, PC operates as a diagnostic imaging center providing services such as X-ray, CT scans, MRI, ultrasound, and other imaging modalities to patients throughout New York. As a medical imaging provider, the organization maintains extensive patient records including imaging studies, radiologist reports, clinical histories, and associated administrative data. The scale of the breach affecting over 600,000 individuals suggests the organization either operates multiple imaging facilities across New York or has been in operation for a considerable period, accumulating a large patient database. Diagnostic imaging centers typically serve as referral destinations for hospitals, primary care physicians, and specialists, meaning the affected population likely spans a broad geographic area and diverse patient demographics across the state.

Patient Impact and Affected Information

Personal Information Involved

While the specific data elements exposed were not enumerated in the breach submission, patients of East River Medical Imaging likely had the following information compromised:

• Full names and contact information (addresses, phone numbers, email addresses)
• Social Security numbers or other government-issued identification numbers
• Date of birth and demographic information
• Insurance information including policy numbers and group numbers
• Medical record numbers and patient account numbers
• Clinical information related to imaging studies and diagnoses
• Physician names and referral information
• Potentially financial information related to billing and payment methods

The exposure of this combination of data types creates significant risk for identity theft, medical fraud, and unauthorized access to ongoing healthcare information.

Number of People Affected

Approximately 605,809 individuals were affected by this breach, making it one of the larger healthcare data breaches reported in 2023. This substantial number indicates the breach compromised core patient database systems rather than isolated records, and affected individuals span multiple years of the organization's patient population. Notification of affected individuals would have been required within 60 days of discovery, with the organization required to provide details about the breach, the types of information exposed, steps individuals should take to protect themselves, and information about credit monitoring or identity theft protection services offered.

Industry Context and HIPAA Implications

Under the HIPAA Breach Notification Rule, a breach is defined as the unauthorized acquisition, access, use, or disclosure of protected health information (PHI) that compromises the security or privacy of such information. Healthcare organizations are required to conduct a risk assessment to determine whether a breach has occurred, notify affected individuals, notify the media (for breaches affecting more than 500 residents of a state or jurisdiction), and notify HHS. The fact that this breach affected over 605,000 individuals triggered mandatory media notification requirements.

Network server breaches represent a significant category of healthcare data breaches, accounting for a substantial portion of large-scale incidents in recent years. According to HHS breach notification data, hacking and IT incidents have become increasingly common as healthcare organizations expand their digital infrastructure and face sophisticated cyber threats. The healthcare sector remains a prime target for cybercriminals due to the high value of medical records on the dark web, where complete patient profiles can command premium prices compared to other types of personal information.

Organizations experiencing breaches of this magnitude typically face significant regulatory scrutiny, potential HIPAA penalties ranging from $100 to $50,000 per violation category, civil litigation from affected patients, reputational damage, and substantial costs associated with breach notification, credit monitoring services, forensic investigation, and remediation efforts. The incident underscores the critical importance of strong cybersecurity controls including network segmentation, multi-factor authentication, regular security assessments, employee training, and incident response planning.