Unfortunately, what Hunters International is doing to a plastic surgery practice in California is nothing new, as I reported at https://www.databreaches.net/another-plastic-surgery-practice-appears-to-have-been-hit-this-time-by-hunters-international/
That report provides a partial chronology of similar breaches involving plastic surgery practices: https://www.databreaches.net/wp-content/uploads/A-Brief-Chronology-of-Cyberattacks-on-Plastic-Surgery-Practices.pdf
I have repeatedly tried to get the American Society of Plastic Surgeons to show me exactly what guidance or advice they have given to members over the past few years concerning the de-identification and protection of patient photos. I have gotten assertions from them that they advise members but I have not gotten any links to any of their publications or specific guidance.
Here is their most recent non-responsive statement to my request for specific links and documents:
"ASPS advises that all patient photos be de-identified to
remove personal information. The Society further recommends that plastic
surgeons conduct routine cybersecurity audits, test for vulnerabilities regularly and administer penetration tests to identify and address any
weaknesses. ASPS is currently developing a cybersecurity program for our
members to better protect both patients and doctors. ASPS also provides online
resources and keeps members informed of best practices and threats through
bulletins and articles."
Anyone have access to those actual bulletins and articles that they have repeatedly failed to provide?
The breaches involving patient data from Gary Motykie, M.D., and Hankins and Sohn were utterly despicable breaches. In attempting not to embarrass patients, though, have these breaches gotten enough attention to serve as a caution or warning to all plastic surgeons? Perhaps not. Media outlets tend to report on AlphV and LockBit and a few other groups that hit the medical sector, but not everything horrific is on those leak sites.
Where are the federal regulators and state attorneys general to enforce privacy and security rules?