Patients at Lakeland’s Watson Clinic received letters notifying them about a breach in the network at the beginning of the year.
“Data breaches are maybe the most common part of cybersecurity today,” said Joshua Sitta, chief information security officer at Sittadel, a Lakeland-based cybersecurity company.
According to a letter sent to potentially impacted patients, an unauthorized third party gained access to part of the network on Jan. 26, 2024, and Watson Clinic discovered the intrusion on Feb. 6.
Watson Clinic spokesperson said the company’s “thorough review” is now complete.
“With the exception of files containing details about one individual, who we previously notified, we have not been able to confirm whether the unauthorized third party actually viewed or acquired the files containing personal information or protected health information,” the statement reads.
Personal information that was potentially accessed could include names, contact information, birthdates, social security numbers and medical records, including details on diagnoses, treatments, or medical record numbers.
“At this moment, I’m just shocked at something like that happening here,” said Patsy Bennett, a Watson Clinic patient who has not received a breach notification letter. “I just don’t want anybody knowing everything, my personal history with the Watson Clinic or anything like that.”
The spokesperson said the letters were being sent to other patients in an “abundance of caution.”
“The trick is that the bad guys are always, always, always changing and it takes a lot of vigilance to make sure that the good guys are always keeping the bad guys out,” Sitta said.
He said it is normal for companies to take several months to notify customers about a breach.
“It’s not just nerdy cyber security work,” Sitta said. “There’s legal implications, there’s PR implications. There’s making sure that your notification letter meets the requirements that the FTC sets forth.”
Sitta advised patients to read the breach notification letter carefully.
A criminal could use health records or other personal information to fraudulently take out loans.
“If you ignore the letter, you could lose big time down the road where a couple of phone calls and the hassle and the headache of dealing with people in a situation that you don’t really understand can sure save you a lot of money long term,” Sitta said.
Watson Clinic patients who receive the notification letter are being offered a complimentary 1-year membership to Experian’s IdentityWorks.
Anyone with questions or concerns can call Watson Clinic at 888-244-3078.
“What you need to do is make sure that you call those numbers, you set up that credit freeze, you take care of yourself because when your information is out there, it can be used to defraud you further,” Sitta said.