University Diagnostic Medical Imaging Data Breach Report

Incident Overview

University Diagnostic Medical Imaging, PC, a diagnostic imaging provider based in New York, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the U.S. Department of Health and Human Services on January 21, 2025, affecting approximately 138,080 individuals. This incident represents a substantial compromise of patient information maintained on the organization's networked systems, exposing protected health information (PHI) to unauthorized parties through what has been classified as a hacking or IT incident.

Discovery and Response Timeline

The specific date of breach discovery was not disclosed in the available submission data, though the January 21, 2025 submission date indicates the organization had completed its investigation and notification process by that time. Standard HIPAA breach notification requirements mandate that covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach. The organization's submission to HHS suggests compliance with these notification timelines, though the exact discovery date would determine the precise notification window. University Diagnostic Medical Imaging likely conducted a forensic investigation to determine the scope of the breach, identify which patient records were accessed, and implement remediation measures to prevent future unauthorized access to their network infrastructure.

Technical Details of the Breach

The breach occurred on a network server, which typically indicates that attackers gained unauthorized access to the organization's internal IT infrastructure rather than a single workstation or portable device. Network server breaches often result from vulnerabilities such as unpatched software, weak authentication credentials, misconfigured firewall rules, or successful phishing attacks that provided attackers with initial access credentials. Once inside the network, threat actors may have been able to move laterally through the system to access patient databases and file repositories containing PHI. The scale of the breach—affecting over 138,000 individuals—suggests the attackers accessed centralized data repositories rather than isolated patient records, indicating either a sophisticated attack or exploitation of a critical vulnerability that provided broad access to the organization's patient information systems.

Organizational Context

University Diagnostic Medical Imaging, PC operates as a diagnostic imaging center, providing services such as X-rays, CT scans, MRI imaging, ultrasound, and other radiological diagnostic procedures. As a diagnostic imaging provider, the organization maintains extensive patient records including imaging studies, radiologist reports, clinical histories, and associated administrative information. The organization serves patients across New York State, with the scale of the breach (138,080 affected individuals) suggesting either a large multi-location operation or a centralized records system serving a substantial patient population. Diagnostic imaging centers typically maintain detailed patient information necessary for scheduling, insurance verification, clinical correlation, and follow-up care coordination, making them attractive targets for healthcare data breaches.

Patient Impact and Affected Information

Approximately 138,080 patients had their protected health information potentially exposed in this breach. While the specific data elements compromised were not detailed in the breach submission, patients of diagnostic imaging centers typically have the following information maintained in networked systems: full names, dates of birth, Social Security numbers, insurance information, medical record numbers, imaging study details, radiologist reports, clinical diagnoses, medical histories, contact information (addresses and phone numbers), and potentially payment information. The large number of affected individuals indicates this was not a targeted attack on specific high-value records but rather a broad compromise of the organization's patient database. Patients should assume that any information they provided to University Diagnostic Medical Imaging during their care may have been exposed to unauthorized parties.

HIPAA Compliance and Industry Context

Under HIPAA regulations, covered entities like University Diagnostic Medical Imaging must implement administrative, physical, and technical safeguards to protect patient PHI. Network server breaches represent a failure of technical safeguards, which should include access controls, encryption, intrusion detection systems, and regular security assessments. The breach notification rule requires covered entities to notify affected individuals, the media (if more than 500 residents of a state are affected), and HHS. Given that this breach affected 138,080 individuals in New York, media notification was likely required. Healthcare data breaches involving network infrastructure compromise have become increasingly common, with attackers targeting healthcare organizations due to the high value of medical records on the dark web and the critical nature of healthcare systems that may incentivize ransom payments. Network server breaches typically result in larger-scale compromises than other breach types, as they provide access to centralized repositories of patient information rather than individual records.