Notice to Patients of North Shore Radiological Associates:

North Shore Radiological Associates (NSRA) was informed on August 2, 2023 of a recent data security incident involving MOVEit software that may have affected the protected health information of approximately 660 NSRA patients residing in Massachusetts. The information involved in this incident that may have been acquired without authorization may have included the patient’s name, NSRA account number, guarantor’s demographics, statement date, amount due, service date, description of the procedure/service, charge amount, payments, adjustments, charge balance and/or location of service. The security incident did not involve any patient Social Security Numbers, credit card numbers, debit card numbers, or other financial account numbers. To be clear, NSRA’s medical record system has not been compromised; rather, NSRA contracts with Healthcare Administrative Partners (HAP) for billing services, HAP contracts with Data Media Associates (DMA), and DMA utilizes the MOVEit Transfer software that experienced a critical vulnerability. DMA states that it took immediate steps to patch its MOVEit system once becoming aware of the incident in June 2023, and completed its investigation of the matter on June 30, 2023.

You can follow the recommendations below to help protect your protected health information. You should also review your account statements and explanation of benefits forms and report any errors or activity you do not recognize to your insurance carrier.

If you have questions about this issue, please call DMA’s dedicated call center for this incident at 888-979-0013 from 9:00 AM to 9:00 PM Eastern Time, Monday through Friday (excluding holidays).

STEPS YOU CAN TAKE TO HELP PROTECT YOUR INFORMATION

Review Your Account Statements and Notify Law Enforcement of Suspicious Activity: As a precautionary measure, you may wish to remain vigilant by reviewing your account statements and credit reports closely. If you detect any suspicious activity on an account, you should promptly notify the financial institution or company with which the account is maintained. You also should promptly report any fraudulent activity or any suspected incidents of identity theft to proper law enforcement authorities, your state attorney general, and/or the Federal Trade Commission (FTC).

Copy of Credit Report: You may obtain a free copy of your credit report from each of the three major credit reporting agencies once every 12 months by visiting www.annualcreditreport.com, calling toll-free 1-877-322-8228, or by completing an Annual Credit Report Request Form and mailing it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348. You also can contact one of the following three national credit reporting agencies:

Equifax

P.O. Box 105851 Atlanta, GA 30348 1-800-525-6285 www.equifax.com

Experian

P.O. Box 9532 Allen, TX 75013 1-888-397-3742 www.experian.com

TransUnion

P.O. Box 1000 Chester, PA 19016 1-800-916-8800 www.transunion.com

Fraud Alert: You may want to consider placing a fraud alert on your credit report. An initial fraud alert is free and stays on your credit file for at least one year. The alert informs creditors of possible fraudulent activity within your report and requests the creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact any of the three credit reporting agencies identified above. Additional information is available at www.annualcreditreport.com.

Security Freeze: You have the right to put a security freeze on your credit file for up to one year at no cost. This prevents new credit from being opened in your name without the use of a PIN number that is issued to you when you initiate the freeze. A security freeze is designed to prevent potential creditors from accessing your credit report without your consent. As a result, using a security freeze may interfere with or delay your ability to obtain credit. You must separately place a security freeze on your credit file with each credit reporting agency. In order to place a security freeze, you may be required to provide the consumer reporting agency with information that identifies you, including your full name, Social Security number, date of birth, current and previous addresses, a copy of your stateissued identification card, and a recent utility bill, bank statement or insurance statement.

Additional Free Resources: You can obtain information from the consumer reporting agencies, the FTC, or from your state Attorney General about fraud alerts, security freezes, and steps you can take toward preventing identity theft. You may report suspected identity theft to local law enforcement, including to the FTC or Attorney General in your state.

Federal Trade Commission

600 Pennsylvania Ave, NW Washington, DC 20580 consumer.ftc.gov 1-877-438-4338

Massachusetts Attorney General

1 Ashburton Place

Boston, MA 02108 https://www.mass.gov/orgs/office-ofthe-attorney-general

(617) 727-8400