Lake Washington Vascular Data Breach Report

Incident Overview

Lake Washington Vascular, a vascular surgery and interventional radiology practice based in Washington State, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the U.S. Department of Health and Human Services on February 25, 2025, affecting 21,534 individuals. The unauthorized access to the network server represents a serious compromise of the organization's information technology security, potentially exposing sensitive patient health information and personal identifiers maintained within their electronic health record systems and associated databases.

Discovery and Response Timeline

While specific details regarding the initial discovery date are not provided in the breach submission, Lake Washington Vascular's notification to HHS on February 25, 2025, indicates the organization followed HIPAA Breach Notification Rule requirements by reporting the incident within the mandated timeframe. The classification as a "hacking/IT incident" suggests the breach resulted from external threat actors gaining unauthorized access to network infrastructure rather than internal mishandling or physical loss of devices. The organization's direct reporting without involvement of a business associate indicates Lake Washington Vascular maintained direct responsibility for the affected systems and data management.

Technical Breach Details

Network server breaches typically occur through multiple potential vectors, including exploitation of unpatched software vulnerabilities, weak authentication credentials, phishing attacks targeting employee credentials, or misconfigured cloud storage and backup systems. The location designation of "Network Server" indicates the breach affected centralized data storage systems rather than isolated workstations or portable devices. This type of breach is particularly concerning because network servers typically contain comprehensive patient records, including historical medical information, treatment plans, diagnostic results, and integrated personal identifiers. Attackers who gain network-level access may be able to exfiltrate large volumes of data simultaneously and potentially maintain persistent access for extended periods before detection. The scale of the breach—affecting over 21,000 individuals—suggests the unauthorized access was not limited to a single patient record or small subset of data, but rather represented broad access to the organization's patient database infrastructure.

Organizational Context

Lake Washington Vascular operates as a specialized vascular medicine practice in Washington State, providing surgical and interventional treatment for vascular conditions including arterial disease, venous insufficiency, and related circulatory disorders. As a vascular specialty practice, the organization maintains detailed clinical information about patients' cardiovascular health, diagnostic imaging results, surgical procedures, and ongoing treatment protocols. The practice serves patients throughout the Washington region and likely maintains multiple clinical locations or a centralized practice with distributed patient access. The involvement of 21,534 affected individuals suggests the practice has substantial patient volume and maintains comprehensive electronic health records spanning multiple years of patient care relationships.

Patient Impact and Notification

All 21,534 individuals whose information was accessible through the compromised network server were affected by this breach. The specific categories of protected health information (PHI) that may have been exposed likely include patient names, dates of birth, Social Security numbers, medical record numbers, insurance information, and detailed clinical information related to vascular conditions and treatments. Patients would have received breach notification letters from Lake Washington Vascular in accordance with HIPAA requirements, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of the breach. The notification should have included information about the types of data compromised, steps the organization is taking to investigate and remediate the breach, recommended protective actions for patients, and contact information for questions or concerns.

HIPAA Compliance and Industry Context

Under the HIPAA Breach Notification Rule, any unauthorized access to unsecured PHI affecting more than 500 residents of a state or jurisdiction must be reported to prominent media outlets in addition to affected individuals and HHS. Network server breaches represent one of the most common categories of healthcare data breaches, accounting for a significant percentage of reported incidents in recent years. The healthcare industry has experienced increasing sophistication in cyberattacks targeting medical practices and health systems, with threat actors recognizing the high value of patient health information on the dark web and in criminal marketplaces. Organizations are required to implement administrative, physical, and technical safeguards to protect electronic PHI, including access controls, encryption, audit logging, and regular security assessments. The occurrence of this breach may indicate gaps in Lake Washington Vascular's security infrastructure, such as insufficient network segmentation, inadequate monitoring of data access, or delayed patching of known vulnerabilities.