Notice of Data Security Incident
Summit Medical Group, PLLC is committed to the security and privacy of the information we maintain. On December 13, 2024, we began mailing notification letters to some of our patients whose information may have been involved in a security incident.
On November 22, 2024, we determined that certain emails or attachments on our email system may have been viewed or copied by an unauthorized party. After we initially identified unusual activity on our email system, we immediately took steps to ensure the security of our system and launched an investigation with third-party forensics experts. The investigation determined that certain Summit email accounts were accessed without authorization between September 19, 2024, and November 21, 2024. Our analysis, which is ongoing, determined that some of the emails and attachments that may have been involved contained information belonging to some of our patients.
The information that may have been involved varies per patient but may include some or all of the following: names, contact information, demographic information, medical record numbers, provider names, dates of services, facilities of service, treatment information, and/or health insurance information.
We encourage patients whose information may have been involved to review the statements they receive from their providers and health insurers. If the statements identify services that were not received, the patient should contact the provider or insurer that issued the statement immediately.
We take this incident very seriously. We notified law enforcement about the incident and provided additional training to the employees whose email accounts were involved. In addition, to help prevent something like this from happening again, we strengthened the security of our email system and will continue enhancing our protocols to safeguard the information in our care.