Associates in Dermatology responds to data breach

Brooke McAfee, The Evening News and the Tribune, Jeffersonville, Ind.
·2 min read

Mar. 20—NEW ALBANY — Associates in Dermatology (AID), a health-care provider with offices in New Albany and Clarksville, is notifying community members of a data breach issue.

On Monday, the provider announced in a news release that Virtual Private Network (VPN) Solutions faced a ransomware issue that could potentially affect patients of the dermatology clinic. The company provides electronic health record management software for the provider.

The New Albany office is at 2241 Green Valley Road, and the Clarksville office is at 1005 E Lewis and Clark Parkway.

The data breach took place around Oct. 31, 2021, leading to a forensic investigation. The investigation did not conclude until January of this year. VPN "identified files pertaining to AID that potentially contained sensitive information."

"On March 10, 2023, AID determined that the compromised files may have also contained personally identifiable information," the news release said. "AID is working to identify all the specific individuals and the type of data that was impacted by VPN's breach in order to provide sufficient notice. AID has no reason to believe that any individual's information has been misused as a result of this event."

The news release said that compromised data may include patients' names, addresses, Social Security numbers, dates of birth, medical conditions, treatments, diagnoses, test results, health insurance policy numbers, subscriber identification numbers and health plan beneficiary numbers. The data that VPN "identified as compromised varied with each individual."

Al Appel, chief administrative officer for AID, said the company is notifying affected individuals "as a matter of precaution."

"As far as we understand, there was not any [protected health information] that was accessed by the hackers," he said.

AID is offering free credit monitoring and identity theft protection to patients potentially affected by the data breach. The provider is sending out letters to notify patients of the data breach and the available services.

Those seeking additional information can call AID's helpline at 1-833-570-2973 between 8 a.m. and 8 p.m. Central Time Monday through Friday.

VPN has also taken steps to secure data, including adding "robust security controls" and endpoint detection/response solutions, according to the news release.

Dr. Al Knable, a dermatologist at AID's New Albany location, encourages patients to sign up for the free credit monitoring services.

"We have 11 locations and cumulatively throughout Kentuckiana, we're seeing probably close to 1,500 patients a day," he said. "It's a huge responsibility that we don't take lightly, which is why we've always exceeded the minimum standards. And with what we're doing now, we're exceeding those standards."