Vision Upright MRI reports data breach affecting over 23,000 individuals

Vision Upright MRI, a medical imaging facility in San Jose, California, has disclosed a data breach that potentially exposed the sensitive personal and medical information of approximately 23,031 individuals across the United States.

What happened

On March 10, 2025, Vision Upright MRI reported a data breach to the U.S. Department of Health and Human Services Office for Civil Rights (HHS). The incident involved unauthorized access to a network server. While the details are still emerging, it is unclear whether the breach directly targeted Vision Upright MRI’s systems or originated through a third-party vendor or business partner. The unauthorized access potentially compromised private and confidential information stored on their network.

What's new

Vision Upright MRI began sending data breach notification letters to affected individuals around March 21, 2025. These letters aim to provide more personalized information about the specific data elements that may have been compromised in each individual case. While the company has not publicly specified the exact types of information involved, healthcare data breaches often include sensitive details protected under HIPAA regulations.

Several law firms, including Shamis & Gentile P.A., Ahdoot Wolfson, and Console & Associates, P.C., have announced investigations into the Vision Upright MRI data breach. These firms are seeking to understand the scope of the breach, the types of information exposed, and potential legal options for affected individuals, including possible class action lawsuits to seek compensation for damages or harm.

What was said

Vision Upright MRI has not yet issued a public press release or a website notice providing additional details about the incident beyond their report to the HHS. The notification sent to the HHS categorizes the breach as a hacking incident affecting a network server. Law firms investigating the breach stress the importance of contacting individuals who received a notification letter to understand their rights and potential for compensation.

Looking ahead

The investigations by legal firms will likely delve into the specifics of how the breach occurred, the security measures Vision Upright MRI had in place, and whether the company adequately protected patient data. Affected individuals are advised to closely monitor their credit reports, financial accounts, and medical records for any suspicious activity. Security experts recommend considering placing a fraud alert or credit freeze on their credit files.

FAQs

What information was exposed? 

While the exact types of compromised data haven't been publicly disclosed by Vision Upright MRI, healthcare data breaches typically involve sensitive personal and medical information such as names, contact information, medical record numbers, health insurance details, treatment information, diagnostic codes, billing information, and potentially Social Security numbers. Affected individuals should review their notification letters for specific details.

What should affected consumers do? 

Security experts recommend monitoring financial statements, reviewing credit reports, and considering credit freezes with the three major credit bureaus (Equifax, Experian, and TransUnion). It’s also important to be vigilant for phishing attempts and to change passwords for affected accounts.

How will consumers be notified? 

Vision Upright MRI is sending written notification letters to all individuals whose information was potentially compromised in the breach.