A breach notice from a company you've never heard of: the Aesto Health breach affecting 9.5 million people and the problem with medical record archives

Aesto's notice says it is provided on behalf of the covered entities and has a section identifying them. The sample letter filed with the California Attorney General is likewise sent by Aesto on behalf of a client provider and names that provider. Don't bin the letter just because you don't know the company; look for the name of a provider you've actually used.

The dedicated line is 833-918-8060 (Monday to Friday, 8 a.m. to 8 p.m. Central, excluding major US holidays), and the notice asks you to have its engagement number ready. The exposed data includes contact and insurance details, so don't trust calls or emails that say "this is Aesto" or "about your hospital's archived records" and ask for your SSN or account number (see what is phishing?).

In the sample letter filed with California, the client provider offers a complimentary 12-month credit monitoring membership. Because the provider is the one offering it, the details and deadline may differ from letter to letter. Follow the enrollment steps and deadline in your own letter.

A credit freeze is free and has to be placed with each of Equifax, Experian and TransUnion. An IRS IP PIN is a six-digit number that, per the IRS, prevents someone else from filing a tax return using your SSN or ITIN. ITINs are on the list of exposed data here, so this applies to people who file with an ITIN too. The IP PIN is valid for one calendar year, and a new one is generated each year. For the full US checklist, including children, see what DentaQuest members should do.

The FTC lists a bill or Explanation of Benefits statement for services you didn't get, or a collector calling about medical debt you don't owe, as signs of medical identity theft. Aesto's notice likewise suggests reviewing your EOB statements, following up on anything you don't recognize with your insurer or provider, and if necessary asking for copies of medical records from the date of the potential access to the present.

A driver's license number can be used in ways a credit freeze doesn't cover. The FTC's advice to contact your state motor vehicle agency is explained in the AssuranceAmerica breach. If a financial account number was involved, review your statements and tell your bank.

EHR and billing migrations, legacy record archives, billing services, document scanning. List every vendor holding patient data, whichever department signed the contract, and for each write down how many years and how many people, which fields (including SSNs or account numbers) and which cloud. In an incident spanning many client providers like this one, that list is where you start working out whether you're affected. The approach is the same as a security inventory.

Confirm the retention periods required by law and contract, and put a procedure for deleting records past their date into the contract and into operations. Federal regulations require business associate contracts to provide that, at termination, the business associate will, if feasible, return or destroy all protected health information and retain no copies (45 CFR 164.504(e)(2)(ii)(J)). When a contract ends, confirm that the return or destruction actually happened.

When moving records off an old system, ask field by field whether SSNs and account numbers really need to move too. Dropping fields you don't need for lookup shrinks what can leak. For retention and backups in general, see backup essentials.

The company says confirming the information involved took a manual document review. If you know which files hold which people's records and which fields for everything you've handed over, you can identify affected people faster after an incident and plan how to reach those with outdated contact details. For the overall approach, see the minimum security baseline for organizations.