Notice of Security Incident
Updated September 7, 2021
CleanSlate Centers, LLC (“CleanSlate”) is providing the following information in order to protect its patients, employees and other persons potentially impacted. Prior notice was provided on this website in July 2021. CleanSlate’s culture is driven by deep compassion for our patients and an unwavering commitment to provide treatment in safe environments that saves lives and restores hope. Because we value our patients’, team members’ and others’ dignity and the need for confidentiality in all aspects of our work, and in coordination with state and national data security requirements, we are providing an update to the prior July notice regarding a data security incident. A written notice has also been mailed to many individuals potentially impacted, but, the investigation is ongoing, and as other individuals are identified, additional individual notices may be delivered.
We sincerely regret any inconvenience or concern caused by this incident.
In the last days of January 2021, a fraudulent actor accessed the email account of a CleanSlate employee. From that time through March 16th, a targeted attack occurred with the intent to divert funds of CleanSlate to a fraudulent account. Information shows that the primary target of the attack was CleanSlate and we have no current evidence of any actual misuse of personal information.
However, it was discovered that the targeted email account contained some limited patient, employee and vendor information and was accessed by an unauthorized person for a few days in January 2021. We have confirmed that the incident was limited to the information in that one email account and did not extend into the CleanSlate network or electronic medical records system.
What has been done?
CleanSlate takes very seriously our duty to protect the personal information in our possession and took immediate action to secure the email account and all information in it. We are continuing to take actions to confirm the security and privacy of all personal information. While there is no current evidence of actual misuse of personal information, this notice is being posted in an effort to notify affected persons of the incident and provide information about how to seek protection. Individual written notice has been provided and CleanSlate has arranged for all potentially impacted persons to receive 24 months of identity theft protection through IDX, an identity theft protection expert.
Who is potentially affected?
If you were a patient, patient guarantor, employee or an individual vendor of CleanSlate since January 1, 2015, your personal information may have been impacted. Individual notices have been mailed to persons who have been identified as having information in the affected email. Because the incident did NOT impact the electronic medical records or network, only limited patients and employees are potentially affected. If you did not receive a notice and have been a patient or employee of CleanSlate, you may contact us at the toll-free number below.
What information was affected?
There was no access to CleanSlate’s patient electronic medical record or network; however, some discreet personal information may have been present in the email account. The extent of the potentially affected personal information is not yet known and will vary between persons, but it may include the following if you are a patient: first and last name, date of birth, medical record number, limited treatment information, provider identity, limited medication information, health plan identity and number, billing and claims information and Social Security Number. If you are an employee the following information may be involved: first and last name, date of birth, health plan identity and number, Social Security Number, credit card number and/or bank account information and PIN/access code.
How can you protect yourself?
To help provide protection, CleanSlate has offered complimentary credit monitoring and identity theft services for two (2) years for potentially affected persons. Please call 833-909-3921 toll-free Monday through Friday from 8 am – 8 pm Central (excluding major U.S. holidays) or go to https://app.idx.us/account-creation/protect for assistance or for any additional questions you may have.
Recommended Steps to help Protect your Information
1. Website and Enrollment. Go to https://app.idx.us/account-creation/protect and follow the instructions for enrollment using your Enrollment Code provided at the top of your notice letter.
2. Activate the credit monitoring provided as part of your IDX identity protection membership. The monitoring included in the membership must be activated to be effective. Note: You must have established credit and access to a computer and the internet to use this service. If you need assistance, IDX will be able to assist you.
3. Telephone. Contact IDX at 833-909-3921 toll-free Monday through Friday from 8 am – 8 pm Central (excluding major U.S. holidays) to gain additional information about this event and speak with knowledgeable representatives about the appropriate steps to take to protect your credit identity.
4. Review your credit reports. We recommend that you remain vigilant by reviewing account statements and monitoring credit reports. Under federal law, you also are entitled every 12 months to one free copy of your credit report from each of the three major credit reporting companies. To obtain a free annual credit report, go to www.annualcreditreport.com or call 1-877-322-8228. You may wish to stagger your requests so that you receive a free report by one of the three credit bureaus every four months.
If you discover any suspicious items and have enrolled in IDX identity protection, notify them immediately by calling or by logging into the IDX website and filing a request for help.
If you file a request for help or report suspicious activity, you will be contacted by a member of our ID Care team who will help you determine the cause of the suspicious items. In the unlikely event that you fall victim to identity theft as a consequence of this incident, you will be assigned an ID Care Specialist who will work on your behalf to identify, stop and reverse the damage quickly.
You should also know that you have the right to file a police report if you ever experience identity fraud. Please note that in order to file a crime report or incident report with law enforcement for identity theft, you will likely need to provide some kind of proof that you have been a victim. A police report is often required to dispute fraudulent items. You can report suspected incidents of identity theft to local law enforcement or to the Attorney General.
5. Place Fraud Alerts with the three credit bureaus. If you choose to place a fraud alert, we recommend you do this after activating your credit monitoring. You can place a fraud alert at one of the three major credit bureaus by phone and also via Experian’s or Equifax’s website. A fraud alert tells creditors to follow certain procedures, including contacting you, before they open any new accounts or change your existing accounts. For that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit. The contact information for all three bureaus is as follows:
Equifax Fraud Reporting
P.O. Box 105069
Atlanta, GA 30348-5069
Experian Fraud Reporting
P.O. Box 9554
Allen, TX 75013
TransUnion Fraud Reporting
P.O. Box 2000
Chester, PA 19022-2000
It is necessary to contact only ONE of these bureaus and use only ONE of these methods. As soon as one of the three bureaus confirms your fraud alert, the others are notified to place alerts on their records as well. You will receive confirmation letters in the mail and will then be able to order all three credit reports, free of charge, for your review. An initial fraud alert will last for one year.
Please Note: No one is allowed to place a fraud alert on your credit report except you.
6. Security Freeze. By placing a security freeze, someone who fraudulently acquires your personal identifying information will not be able to use that information to open new accounts or borrow money in your name Keep in mind that when you place the freeze, you will not be able to borrow money, obtain instant credit, or get a new credit card until you temporarily lift or permanently remove the freeze. There is no cost to freeze or unfreeze your credit files. Under federal law, you cannot be charged to place, lift, or remove a security freeze.
You will need to contact IDX or the three national credit reporting bureaus listed above to place the freeze and provide some or all of the following information to the credit reporting agency, depending on whether you do so online, by phone, or by mail: 1. Your full name (including middle initial as well as Jr., Sr., II, III, etc.); 2. Social Security Number; 3. Date of birth; 4. If you have moved in the past five (5) years, the addresses where you have lived over the prior five years; 5. Proof of current address, such as a current utility bill, telephone bill, rental agreement, or deed; 6. A legible photocopy of a government issued identification card (state driver’s license or ID card, military identification, etc.); 7. Social Security Card, pay stub, or W2; 8. If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft. The credit reporting agencies have one (1) to three (3) business days after receiving your request to place a security freeze on your credit report, based upon the method of your request. The credit bureaus must also send written confirmation to you within five (5) business days and provide you with a unique personal identification number (PIN) or password (or both) that can be used by you to authorize the removal or lifting of the security freeze. It is important to maintain this PIN/password in a secure place, as you will need it to lift or remove the security freeze. To lift the security freeze in order to allow a specific entity or individual access to your credit report, you must make a request to each of the credit reporting agencies by mail, through their website, or by phone (using the contact information above). You must provide proper identification (including name, address, and social security number) and the PIN number or password provided to you when you placed the security freeze, as well as the identities of those entities or individuals you would like to receive your credit report. You may also temporarily lift a security freeze for a specified period of time rather than for a specific entity or individual, using the same contact information above. The credit bureaus have between one (1) hour (for requests made online) and three (3) business days (for request made by mail) after receiving your request to lift the security freeze for those identified entities or for the specified period of time. To remove the security freeze, you must make a request to each of the credit reporting agencies by mail, through their website, or by phone (using the contact information above). You must provide proper identification (name, address, and social security number) and the PIN number or password provided to you when you placed the security freeze. The credit bureaus have between one (1) hour (for requests made online) and three (3) business days (for requests made by mail) after receiving your request to remove the security freeze.
Additional resources regarding identity theft protection may be found at:
Arizona Residents: Visit the Office of the Attorney General of Arizona (https://www.azag.gov/consumer/data-breach/identity-theft) for additional information on protection against identity theft.
California Residents: Visit the California Office of Privacy Protection (www.oag.ca.gov/privacy) for additional information on protection against identity theft.
Connecticut Residents: Visit the Office of the Attorney General of Connecticut website for additional information on protection against identity theft at https://portal.ct.gov/AG/Departments/Privacy/The-Privacy-and-Data-Security-Department
Indiana Residents: Office of the Attorney General of Indiana Consumer Protection Division, www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/ or call (800) 382-5516
Kentucky Residents: Office of the Attorney General of Kentucky, 700 Capitol Avenue, Suite 118 Frankfort, Kentucky 40601, www.ag.ky.gov, Telephone: 1-502-696-5300.
Maryland Residents: Office of the Attorney General of Maryland, Consumer Protection Division 200 St. Paul Place Baltimore, MD 21202, www.oag.state.md.us/Consumer, Telephone: 1-888-743-0023.
Massachusetts Residents: You have the right to obtain any police report filed in regard to this incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it. You may also place a security freeze on your credit reports, free of charge, as described earlier. Visit the Office of Consumer Affairs and Business Regulation, 501 Boylston Street, Suite 5100, Boston, MA 02116, on its website (https://www..mass.gov/info-details/protecting-your-privacy) or call (888) 283-3757 for additional information on protection against identity theft.
New York Residents: the Attorney General may be contacted at: Office of the Attorney General, The Capitol, Albany, NY 12224-0341; 1-800-771-7755; https://ag.ny.gov/.
North Carolina Residents: North Carolina Attorney General at: North Carolina Consumer Protection Division, 9001 Mail Service Center, Raleigh, NC 27699-9001, or call: 1-877-566-7226 or 1-919-716-6000, or online at: https://ncdoj.gov/protecting-consumers/protecting-your-identity/
Ohio Residents: Ohio Attorney General’s Office, www.OhioAttorneyGeneral.gov or 800-282-0515 https://www.ohioattorneygeneral.gov/Individuals-and-
Oregon Residents: Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096, www.doj.state.or.us/, Telephone: 877-877-9392
Rhode Island Residents: Office of the Attorney General, 150 South Main Street, Providence, Rhode Island 02903, www.riag.ri.gov, Telephone: 401-274-4400
Wisconsin Residents: Bureau of Consumer Protection, 2811 Agriculture Drive, Madison, WI 53708-8911, (800) 422-7128 or https://datcp.wi.gov/Pages/Programs_Services/IdentityTheft.aspx
All US Residents: Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue, NW Washington, DC 20580, www.consumer.gov/idtheft, 1-877-IDTHEFT (438-4338), TTY: 1-866-653-4261.