Cybersecurity Incident

Notice of Data Event

St. Clair Orthopaedics and Sports Medicine is writing to inform you of a recent data security incident that involved patient information. SCOSM takes the privacy and security of all information within its possession seriously and this notice provides information regarding the incident, our response, and steps that individuals can take to help protect their information.

What Happened. SCOSM discovered suspicious activity within its network on November 24, 2024.  SCOSM immediately investigated the activity and engaged cybersecurity specialists to assist with determining the nature and scope of unauthorized network access.  On December 9, 2024, the investigation determined some of the impacted locations contained patient information.  After completing the investigation on December 20, 2024, SCOSM undertook a comprehensive review of those files to confirm the specific information present, which completed on January 29, 2025, from this review, SCOSM learned patient information was within the impacted network locations and notified patients.

What Information Was Involved. The information involved may have included contact information (such as name, address, date of birth, phone number, and email) plus one or more of the following.

• Health insurance data (such as health plans/policies, insurance companies, member/group ID numbers, and Medicaid-Medicare government payor ID numbers)
• Health data (such as medical record numbers, doctors, diagnosis, medicines, test results, images, care, and treatment)
• Billing, insurance claims and payment data (such as claim numbers, account numbers, billing codes and balances)
• Other personal data (such as Social Security number, driver’s license or state ID number, or other ID number)

What We Are Doing. SCOSM took immediate steps after discovering the incident to ensure its network security and to contain the incident.  SCOSM also investigated the incident with specialists as described above and implemented measures to enhance security and minimize the risk of subsequent data breach. SCOSM is notifying relevant patients.

What You Can Do. You can follow the recommendations on the following page to help protect your information.  They provide resources individuals can use every day to protect information.

For More Information. We value our relationship with our patients and take your trust in us and this matter very seriously.   Further information about how to protect your personal information appears on the following page.  If you have questions please email us at dataleak@scosm.net. Monday through Friday from 830am-5pm.

Steps You Can Take to Help Protect Your Personal Information

Review Your Account Statements and Notify Law Enforcement of Suspicious Activity: As a precautionary measure, we recommend that you remain vigilant by reviewing your account statements and credit reports closely. If you detect any suspicious activity on an account, you should promptly notify the financial institution or company with which the account is maintained. You also should promptly report any fraudulent activity or any suspected incidence of identity theft to proper law enforcement authorities, your state attorney general, and/or the Federal Trade Commission.

Copy of Credit Report: You may obtain a free copy of your credit report from each of the three major credit reporting agencies once every 12 months by visiting www.annualcreditreport.com, calling toll-free 1-877-322-8228, or by completing an Annual Credit Report Request Form and mailing it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348. You also can contact one of the following three national credit reporting agencies:

 Fraud Alert: You may want to consider placing a fraud alert on your credit report. An initial fraud alert is free and will stay on your credit file for at least one year. The alert informs creditors of possible fraudulent activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact any of the three credit reporting agencies identified above. Additional information is available at www.annualcreditreport.com.

Security Freeze: You have the right to put a security freeze on your credit file for up to one year at no cost. This will prevent new credit from being opened in your name without the use of a PIN number that is issued to you when you initiate the freeze. A security freeze is designed to prevent potential creditors from accessing your credit report without your consent. As a result, using a security freeze may interfere with or delay your ability to obtain credit. You must separately place a security freeze on your credit file with each credit reporting agency. In order to place a security freeze, you may be required to provide the consumer reporting agency with information that identifies you including your full name, Social Security number, date of birth, current and previous addresses, a copy of your state-issued identification card, and a recent utility bill, bank statement or insurance statement.

Additional Free Resources: You can obtain information from the consumer reporting agencies, the FTC, or from your respective state Attorney General about fraud alerts, security freezes, and steps you can take toward preventing identity theft. You may report suspected identity theft to local law enforcement, including to the FTC or to the Attorney General in your state.  The FTC can be contacted at 600 Pennsylvania Ave, NW, Washington, DC 20580; consumer.ftc.gov; or 877-438-4338.

You also have certain rights under the Fair Credit Reporting Act (FCRA): These rights include to know what is in your file; to dispute incomplete or inaccurate information; to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information; as well as other rights. For more information about the FCRA, and your rights pursuant to the FCRA, please visit www.consumer.ftc.gov/sites/default/files/articles/pdf/pdf-0096-fair-credit-reporting-act.pdf.