OrthoSC was the recent victim of a data security event. On November 19, 2019, we discovered that an unauthorized user had accessed the email account of a single OrthoSC employee on several very brief occasions during the period November 15 to November 19, 2019. We immediately terminated the unauthorized access as soon as it was discovered, and we hired expert information security consultants to investigate, mitigate and assess the extent of this event and to help further strengthen our information security, and we are continuing to work closely with consultants to further strengthen our computer network.
Fortunately, after expert analysis and extensive investigation, OrthoSC does NOT believe that any patient’s specific information was accessed or that any personal information was actually removed from our computer network. Additionally, there was no access to our medical records database. However, at the time of the event documents containing information commonly found in a medical record, such as full name, address, date of birth, age, date of service, patient account number, diagnoses and treatment, medical history and similar information found in a medical chart were located in the affected email account. In a small number of cases, certain documents contained social security numbers and/or financial account numbers.
While there is no evidence that any of this information was actually accessed or removed from our computer system, in an abundance of caution OrthoSC is notifying all individuals whose personal information may have been in this email account at the time of the event by letter at their last known address, and is offering these individuals one year of free identity theft protection services in the case of any potential harm that may have occurred as a result of this incident, through MyIDCare™ from ID Experts®. These services include: 12 months of credit monitoring, a $1 million insurance reimbursement policy with no deductible from an AM. Best “A-rated” carrier, and fully-managed ID theft recovery services. With this protection, MyIDCare will help you resolve issues if your identity is compromised. A full description of the offered services may be found at https://app.myidcare.com/account-creation/protect.
If you receive such a letter, like that referenced above and wish to activate your identity protection services, please go to https://app.myidcare.com/account-creation/protect and use the Enrollment Code provided in your patient notification letter. Please note that the deadline to enroll is 90 days from the date of the letter. If you do not receive a letter but believe that you should have, or if you misplace your code or simply have other questions, please call 1-800-939-4170 Monday through Friday 9 a.m. to 9 p.m. EST. This number will be available until November 22, 2020.
OrthoSC is fully committed to protecting the confidentiality of personal information. We sincerely regret this happened and apologize for any inconvenience or alarm this situation has caused. We are grateful to serve as your orthopedic healthcare provider.