PET Imaging of Dallas Northeast Email Breach Report

Opening Summary

PET Imaging of Dallas Northeast, a diagnostic imaging facility located in Texas, experienced a significant data breach involving unauthorized access to its email systems. The breach was reported to the U.S. Department of Health and Human Services on June 27, 2025, affecting approximately 1,935 individuals. The unauthorized access to email systems represents a common but serious vulnerability in healthcare IT infrastructure, as email accounts frequently contain unencrypted protected health information (PHI) including patient names, medical record numbers, dates of birth, insurance information, and clinical notes.

Discovery and Response Timeline

While specific details regarding the initial discovery date are not provided in the breach submission, the June 27, 2025 submission date indicates that PET Imaging of Dallas Northeast identified the incident and initiated the mandatory HIPAA breach notification process within the required timeframe. Healthcare organizations are required under HIPAA Breach Notification Rule to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach. The involvement of a business associate in this incident suggests that the breach may have involved third-party vendors or service providers with access to the facility's email systems, such as IT support contractors, cloud service providers, or electronic health record (EHR) vendors. PET Imaging would have been required to notify both the affected individuals and their business associates of the breach circumstances and recommended protective measures.

Technical Details of the Breach

The breach occurred through hacking or IT incident targeting the organization's email infrastructure. Email systems are frequently targeted by threat actors because they serve as centralized repositories for sensitive communications and often contain PHI that is transmitted in plain text or with minimal encryption. Common attack vectors for email breaches include phishing campaigns designed to capture employee credentials, exploitation of unpatched email server vulnerabilities, brute force attacks against weak passwords, and compromise of email accounts through credential stuffing using previously leaked password databases. Once attackers gain access to email accounts, they can typically access months or years of historical messages containing patient information, appointment details, insurance data, and clinical communications. The fact that this breach affected email systems rather than a centralized database suggests that the exposure may have been more diffuse, with multiple email accounts potentially compromised rather than a single point of failure.

Organizational Context

PET Imaging of Dallas Northeast is a specialized diagnostic imaging facility providing Positron Emission Tomography (PET) scanning services in the Dallas area of Texas. PET imaging is an advanced nuclear medicine diagnostic tool used to detect cancer, cardiac disease, and neurological conditions by visualizing metabolic activity. As a diagnostic imaging center, PET Imaging of Dallas Northeast likely operates as an outpatient facility serving patients referred from primary care physicians, oncologists, cardiologists, and neurologists throughout the Dallas-Fort Worth metropolitan region. The facility would maintain comprehensive patient records including demographic information, insurance details, medical histories, imaging reports, and referring physician communications. The involvement of a business associate indicates that the organization relies on external vendors for critical functions such as IT infrastructure management, cloud-based EHR systems, billing and claims processing, or medical records storage and retrieval.

Patient Impact and Affected Information

Approximately 1,935 individuals were affected by this breach of PET Imaging of Dallas Northeast's email systems. These individuals likely include current and former patients who had undergone PET imaging procedures at the facility, as well as potentially individuals who had inquired about services or had communications with the organization. The protected health information that may have been accessed through compromised email accounts typically includes: patient names, dates of birth, medical record numbers, Social Security numbers (if used for identification purposes), insurance information including policy numbers and group numbers, clinical diagnoses and medical histories, imaging reports and findings, appointment dates and times, referring physician information, emergency contact information, and potentially payment and billing information. The exposure of this combination of data elements creates significant risk for identity theft, insurance fraud, and medical identity theft, as threat actors could potentially use the information to fraudulently obtain medical services or access insurance benefits.

HIPAA Compliance and Industry Context

Under the HIPAA Breach Notification Rule, any unauthorized access to unsecured PHI must be reported to affected individuals, the media (if more than 500 residents of a state are affected), and the HHS Office for Civil Rights. Email breaches represent a significant category of healthcare data breaches, accounting for a substantial portion of reported incidents annually. The healthcare industry has experienced a marked increase in email-targeted attacks in recent years, with threat actors recognizing that healthcare organizations often maintain less strong email security compared to other critical infrastructure sectors. Best practices for preventing email breaches include implementation of multi-factor authentication, regular security awareness training for employees, encryption of email in transit and at rest, advanced threat detection systems, and regular security audits of email infrastructure. The involvement of a business associate in this breach underscores the importance of vendor risk management and contractual requirements for business associates to maintain appropriate safeguards for PHI under their control.