US Radiology Specialists Network Server Breach Report

Opening Summary

US Radiology Specialists, Inc., a North Carolina-based radiology services provider, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was discovered and reported to the U.S. Department of Health and Human Services on February 18, 2022, affecting 87,552 individuals. The incident involved a hacking or IT-related attack that compromised protected health information (PHI) stored on the organization's network servers. This breach represents a substantial security incident affecting a large patient population across the radiology services sector.

Discovery and Response Timeline

US Radiology Specialists identified the unauthorized access to its network server through security monitoring systems and incident detection protocols. Upon discovery, the organization initiated a comprehensive investigation to determine the scope of the breach, identify affected individuals, and assess what types of patient information may have been accessed. The entity worked to contain the breach, secure its systems, and prepare notifications for affected patients as required under the Health Insurance Portability and Accountability Act (HIPAA) Breach Notification Rule. The submission date of February 18, 2022, indicates the organization met its obligation to report the breach to HHS within 60 days of discovery, as mandated by federal regulations.

Technical Details of the Breach

The breach occurred through unauthorized access to the organization's network server infrastructure, which typically serves as a centralized repository for patient records, imaging data, appointment information, and associated clinical documentation. Network server breaches of this nature commonly result from vulnerabilities such as unpatched software, weak authentication credentials, phishing attacks targeting employee credentials, or exploitation of misconfigured network access controls. The fact that a business associate was involved in this incident suggests that the compromised network may have included systems shared with or accessed by third-party vendors, contractors, or service providers who handle radiology data on behalf of the primary organization. This multi-party access environment increases the complexity of breach investigation and remediation efforts.

Organizational Context

US Radiology Specialists, Inc. operates as a radiology services provider in North Carolina, offering diagnostic imaging and related clinical services to patients throughout the state. Radiology practices typically maintain extensive digital records including medical images (X-rays, CT scans, MRI images), radiologist reports, patient demographics, insurance information, and clinical histories. The organization's size—affecting nearly 88,000 individuals—indicates it likely operates multiple facilities or serves a substantial regional patient population. As a healthcare entity handling sensitive diagnostic information, US Radiology Specialists is subject to HIPAA regulations and must maintain appropriate safeguards to protect patient privacy and data security.

Patient Impact and Affected Population

The breach affected 87,552 individuals whose information was stored on the compromised network server. These patients likely include individuals who underwent radiology services at US Radiology Specialists facilities or affiliated healthcare providers over an extended period. The compromised data may have included names, dates of birth, medical record numbers, insurance information, Social Security numbers, and detailed clinical information related to radiology procedures and diagnoses. Patients were notified of the breach through written notification letters as required by HIPAA regulations, which mandate that covered entities inform affected individuals of breaches without unreasonable delay and no later than 60 days after discovery. The notification process for nearly 88,000 individuals represents a significant administrative undertaking requiring coordination of mailing lists, letter preparation, and call center resources to handle patient inquiries.

HIPAA Compliance and Industry Context

Under the HIPAA Breach Notification Rule, covered entities and business associates must notify affected individuals, the media (for breaches affecting more than 500 residents of a state or jurisdiction), and the Secretary of HHS when unsecured PHI is accessed, acquired, used, or disclosed in a manner not permitted by the Privacy Rule. Network server breaches represent a significant category of healthcare data incidents, accounting for a substantial portion of reported breaches in the healthcare sector. According to HHS breach notification data, hacking and IT incidents have consistently ranked among the top causes of healthcare data breaches, often resulting in large-scale exposures due to the centralized nature of network infrastructure. The involvement of a business associate in this incident underscores the importance of vendor management and third-party risk assessment in healthcare organizations. Covered entities remain liable for breaches involving business associates' systems, making it essential to establish strong contractual safeguards, security requirements, and incident response protocols with all vendors handling PHI.