Eye Physicians of Central Florida Data Breach Report

Incident Overview

Eye Physicians of Central Florida, PLLC, a division of Florida Pediatric Associates, LLC, experienced a significant data breach affecting 31,189 individuals. The breach was discovered and reported to the U.S. Department of Health and Human Services on December 22, 2023. The unauthorized access occurred on the organization's network server infrastructure, compromising protected health information (PHI) of patients who received eye care services through the practice. This incident represents a hacking or IT-related security compromise rather than physical theft or loss of records, indicating that attackers gained unauthorized access to the organization's digital systems.

Discovery and Response Timeline

The specific date of breach discovery and the organization's response timeline were not detailed in the available breach notification data. However, HIPAA regulations require covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach. Eye Physicians of Central Florida's submission to the HHS Breach Notification Portal on December 22, 2023, indicates that the organization completed its investigation and notification process by that date. Standard breach response protocols typically include immediate containment of the compromised systems, forensic investigation to determine the scope and nature of unauthorized access, notification to affected individuals, and implementation of remedial security measures to prevent recurrence.

Technical Details of the Breach

The breach occurred on a network server, which typically serves as a centralized repository for patient records, scheduling information, billing data, and other operational information. Network server compromises in healthcare settings often result from vulnerabilities such as unpatched software, weak authentication credentials, misconfigured access controls, or successful phishing attacks that provide attackers with initial system access. Once inside the network, attackers may have been able to move laterally through the organization's IT infrastructure to access multiple systems and databases containing patient information. The fact that this was classified as a hacking/IT incident rather than a ransomware attack suggests that the primary concern was unauthorized data access rather than encryption or extortion, though the full nature of the attack cannot be determined from available information.

Organizational Context

Eye Physicians of Central Florida, PLLC operates as a specialized ophthalmology practice serving patients in the Central Florida region. As a division of Florida Pediatric Associates, LLC, the organization provides eye care services to patients, including comprehensive eye examinations, diagnosis and treatment of eye conditions, and potentially surgical services. The practice maintains electronic health records (EHRs) and patient management systems typical of modern medical practices, which store sensitive patient information necessary for clinical care, billing, and insurance coordination. The organization's size, as indicated by the number of affected individuals, suggests it operates multiple locations or serves a substantial patient population across the Central Florida area.

Patient Impact and Affected Population

Approximately 31,189 individuals had their protected health information potentially compromised in this breach. This population includes current and former patients of Eye Physicians of Central Florida who had records stored on the compromised network server. The affected individuals likely span multiple years of the practice's operations, as network servers typically contain historical patient records maintained for continuity of care and legal compliance purposes. Patients were notified of the breach through written notification letters, as required by HIPAA's Breach Notification Rule. The notification process would have included information about the types of data compromised, steps the organization was taking to address the breach, and recommended actions for patients to protect themselves from potential misuse of their information.

HIPAA Compliance and Industry Context

Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities like Eye Physicians of Central Florida are required to implement administrative, physical, and technical safeguards to protect patient privacy and security. Network server breaches represent a failure in technical safeguards, which should include access controls, encryption, audit controls, and integrity controls. The Breach Notification Rule requires covered entities to notify affected individuals, the media (if more than 500 residents of a state are affected), and the Secretary of Health and Human Services of breaches of unsecured PHI. Healthcare data breaches involving hacking or IT incidents have become increasingly common, with network vulnerabilities and sophisticated cyber attacks representing significant threats to healthcare organizations of all sizes. According to HHS data, hacking incidents consistently account for a substantial portion of reported healthcare breaches, often affecting larger numbers of individuals than other breach types due to the centralized nature of network systems.