On May 10, DataBreaches.net broke the story of a medical collection agency breach involving American Medical Collection Agency. The breach had been discovered by Gemini Advisory, who informed this site that they had found approximately 200,000 patients’ payment card info for sale on a well-known marketplace. The cards had apparently been compromised between September, 2018 and the beginning of March, 2019.
When AMCA did not respond to Gemini’s notification attempt, Gemini Advisory reported their findings to law enforcement, who then contacted AMCA.
AMCA did not subsequently respond to DataBreaches.net’s questions about the incident, although by May 10, it was clear that AMCA knew and had been addressing the problem (as screenshots this site published suggested).
Today, ABC news reports that AMCA has reportedly informed Quest Diagnostics that 11.9 million of their patients may be impacted — and that’s just one company. ABC reports:
AMCA believes this information includes personal information, including certain financial data, Social Security numbers, and medical information, but not laboratory test results.
Quest reports that AMCA has not yet provided them or Optum360 detailed or complete information about the AMCA data security incident, including which information of which individuals may have been affected.
Quest also said in a statement that they have “not been able to verify the accuracy of the information received from AMCA.”
I expect we’ll see a lot more coverage on this breach now that some larger numbers are being reported. The following is Quest Diagnostics’ statement from their web site. I still don’t see any mention of HIPAA, but it would seem to be implicated in this incident.
SECAUCUS, N.J., June 03, 2019 — American Medical Collection Agency (AMCA), a billing collections service provider, has informed Quest Diagnostics that an unauthorized user had access to AMCA’s system containing personal information AMCA received from various entities, including from Quest. AMCA provides billing collections services to Optum360, which in turn is a Quest contractor. Quest and Optum360 are working with forensic experts to investigate the matter.
AMCA first notified Quest and Optum360 on May 14, 2019 of potential unauthorized activity on AMCA’s web payment page. On May 31, 2019, AMCA notified Quest and Optum360 that the data on AMCA’s affected system included information regarding approximately 11.9 million Quest patients. AMCA believes this information includes personal information, including certain financial data, Social Security numbers, and medical information, but not laboratory test results.
AMCA has not yet provided Quest or Optum360 detailed or complete information about the AMCA data security incident, including which information of which individuals may have been affected. And Quest has not been able to verify the accuracy of the information received from AMCA.
Quest is taking this matter very seriously and is committed to the privacy and security of our patients’ personal information. Since learning of the AMCA data security incident, we have suspended sending collection requests to AMCA.
Quest will be working with Optum360 to ensure that Quest patients are appropriately notified consistent with the law.
We are committed to keeping our patients, health care providers, and all relevant parties informed as we learn more.
Update, June 4: Gemini Advisory has issued a statement about their findings and role on their blog.
Mine was stolen on May 7th. Someone used my debit card number at a Target in New York and I live in Alabama. They got every cent I had in the bank and my line of credit. I am on a fixed income and now I have to call my creditors and the credit agencies to tell them. I was on the phone for 59 minutes with Equifax trying to tell them what happened. I have had to call others also. Something needs to be done to catch and to put these people who do this as they say under the jail. They need to get a real job and not be a thief of others who have worked hard all their lives and done without to have something. Just saying…