Vendor Scam Results in Data Breach Involving 17k Patients

North Carolina-based Raleigh Orthopaedic Clinic has notified approximately 17,300 patients that x-ray films belonging to them and taken prior to 2008 may have been provided to a third-party vendor, which sold the films to an Ohio-based recycling company that harvested the silver from the X-rays.

In January 2013, Raleigh Orthopaedic Clinic (Raleigh Ortho) contracted with a third party vendor to transfer old x-ray films into electronic format.  Raleigh Ortho provided the vendor with the x-ray films, but the vendor never provided Raleigh Ortho with an electronic version of the films.  Raleigh Ortho performed an investigation and, during the first week of March 2013, discovered that it had been the victim of a scam. It appears that the x-ray films were sold to a recycling company in Ohio that harvested the silver from the films.  Raleigh Ortho believes the films were ultimately destroyed.

The patients have been further notified that their full name and date of birth would have accompanied the films.  Raleigh Ortho does not believe that any other individually identifiable information was on the x-rays.  Nevertheless, Raleigh Ortho has recommended that the patients remain vigilant by reviewing their account statements and monitoring their credit reports.

Raleigh Ortho no longer has the contact information for some of the patients who may be affected, and is therefore posting this information on its website. Although Raleigh Ortho has not received any indication that patient information has been misused by any unauthorized individual, Raleigh Ortho has no way of knowing whether or how patient information may have actually been used.