Riverdale Mental Health d/b/a Mosaic Mental Health Data Breach

On September 25, 2023, Riverdale Mental Health, operating under the name Mosaic Mental Health in New York, reported a significant data breach involving unauthorized access to its network server infrastructure. The breach resulted in the exposure of protected health information (PHI) belonging to approximately 7,281 individuals. This incident represents a hacking or IT-related security compromise rather than physical theft or loss, indicating that attackers gained unauthorized access to the organization's digital systems and the sensitive patient data stored within them.

Company Response

Upon discovery of the unauthorized access, Riverdale Mental Health d/b/a Mosaic Mental Health initiated a comprehensive investigation to determine the scope and nature of the breach. The organization worked to identify which patient records were accessed, what specific information may have been compromised, and the methods used by the attackers to gain entry to their network infrastructure. In compliance with HIPAA Breach Notification Rule requirements, the organization notified affected individuals of the breach. The submission date of September 25, 2023, indicates when the breach was formally reported to state authorities and likely represents the completion of the initial investigation phase.

Specific Details

The breach occurred on a network server, which typically serves as a centralized repository for patient data, electronic health records (EHRs), and other critical healthcare information. Network server compromises often result from vulnerabilities such as unpatched software, weak authentication credentials, misconfigured security settings, or successful phishing attacks that provide attackers with initial access credentials. Once inside the network, attackers may have been able to navigate laterally through the system to access multiple databases containing patient information. The fact that this breach affected over 7,000 individuals suggests the attackers gained access to a significant portion of the organization's patient database rather than isolated records.

Organizational Context

Riverdale Mental Health, operating as Mosaic Mental Health, is a mental health services provider based in New York. The organization provides psychiatric and behavioral health services to patients throughout the state. Mental health providers typically maintain particularly sensitive patient information, including detailed clinical notes, psychiatric diagnoses, medication histories, and treatment plans—all of which are considered highly sensitive PHI. The fact that no business associate was involved in this breach indicates that the compromised systems were directly operated and maintained by Riverdale Mental Health itself, rather than through a third-party vendor or service provider.

Patient Impact and Notifications

Approximately 7,281 patients of Riverdale Mental Health d/b/a Mosaic Mental Health were affected by this breach. These individuals had their protected health information potentially accessed by unauthorized parties. The specific data elements exposed likely include names, dates of birth, medical record numbers, insurance information, and clinical information related to mental health treatment. Affected patients were notified of the breach in accordance with HIPAA requirements, which mandate notification without unreasonable delay and no later than 60 calendar days after discovery of a breach. The notification would have included information about what data was compromised, what steps the organization was taking to address the breach, and recommended actions patients should take to protect themselves.

HIPAA and Industry Context

Under the HIPAA Breach Notification Rule, covered entities like Riverdale Mental Health must notify affected individuals when there is a breach of unsecured PHI. A breach is defined as unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of the information. Network server breaches represent a significant category of healthcare data breaches, accounting for a substantial portion of reported incidents in the healthcare industry. According to HHS breach notification data, hacking and IT incidents have become increasingly common in healthcare, often resulting from sophisticated cyber attacks targeting healthcare organizations' digital infrastructure. The exposure of mental health records is particularly concerning due to the sensitive nature of psychiatric information and the potential for misuse, including discrimination, stigmatization, or identity theft. Mental health providers face unique cybersecurity challenges due to the high value of their data to criminals and the critical importance of maintaining patient confidentiality in this sensitive healthcare domain.