East Suburban clinic reports data breach affecting 500 patients

East Suburban Sports Medicine Center, an athletic training and physical therapy center with branches in Allegheny and Westmoreland counties, announced a data security breach that affected more than 500 Pennsylvania residents.

Last spring, two patients told center officials that, when they ran a Google search for their names, the results included their names and email addresses and a link to the ESSMC website, according to ESSMC President Jon Bonaroti.

“This link, however, was a ‘broken’ link, which means that, if a user clicked on the link, the user would receive an error message and would not be able to access any further information beyond what was in the text (previewing the Google search results),” Bonaroti wrote in a letter to the Tribune-Review.

ESSMC officials immediately disabled the section of their website which was causing the problem and ran random audits to ensure the information — which came from an ESSMC spreadsheet — was no longer available.

ESSMC officials also notified federal regulators, consistent with the federal Health Insurance Portability and Accountability Act (HIPAA), and the center’s affected patients were informed on April 1.

Bonaroti wrote that only patient names and email addresses were accessible.

“No other protected health information or other personal information was disclosed as a result of this breach,” he wrote.

Patients also were provided with contact information for both the Pennsylvania Attorney General’s Office and the Federal Trade Commission, should additional information about identity theft prevention be needed.

Patients can also contact ESSMC directly by emailing john@essmc.com or calling 412-856-8060, ext. 210.

ESSMC has offices in Murrysville, Monroeville, North Huntingdon, Penn Hills, Penn Township and Plum.