Broadway Medical Clinic Data Breach Notice (Oregon Attorney General)

The Broadway Medical Clinic notified one Oregon resident that their personal information was exposed in an incident on March 21, 2025. The filing reached the Oregon Department of Justice on April 25, 2025 — 35 days later.

Your information cannot be taken back

Once personal information leaves a clinic’s systems, it stays available to whoever obtained it. That is now the permanent reality for the single person named in this filing. The record lists only personal information as exposed. No passwords, no financial account numbers, and no permanent government identifiers such as Social Security numbers appear in the disclosed categories.

What this exposure actually enables

Medical clinic records almost always tie personal details to healthcare history. Even limited personal information can give a fraudster enough context to attempt insurance fraud, file false claims, or craft convincing social-engineering calls that sound as though they come from the clinic itself. Because the affected individual is a patient, the exposed data is likely linked to treatment or billing records that cannot be changed or reissued.

The fact that only one person was affected does not reduce the risk to that person. A breach of this size usually means the clinic isolated the incident quickly or that the exposed record belonged to a single file accessed or taken during the event on March 21.

The letter is the only reliable way to know if this concerns you

Broadway Medical Clinic is required to notify affected individuals directly, almost always by mail. If you have not received a letter from the clinic, your records were almost certainly not part of this incident. However, if you have moved since March 21, 2025, or changed addresses without notifying the clinic, a letter may have gone to an old address. In that case, contact Broadway Medical Clinic directly to confirm whether your information was included.

Why the 35-day timeline matters

The gap between the March 21 incident and the April 25 filing is modest by the standards of many breach notifications. State rules in Oregon allow organisations time to investigate and prepare notifications. The record does not disclose when the clinic discovered the incident, so it is not possible to calculate how long the information may have been accessible before they acted. What is known is that the clinic completed its required filing within five weeks.

The risks that remain permanent

Personal information tied to medical care creates two long-term concerns that cannot be fixed by changing a password or cancelling a card:

• Insurance fraud attempts. Someone with your name, date of birth, and policy details can try to obtain medical services or prescriptions in your name, which may appear on your Explanation of Benefits or affect future coverage.
• Targeted impersonation. A caller who already knows details of your past treatment can sound legitimate when they ask for more information or try to redirect payments or records.

No passwords were exposed, so there is no need to change any login credentials because of this specific incident. That is genuine good news and removes one common source of immediate panic.

What you can still control

While the exposed personal information cannot be retracted, you retain control over how closely you monitor the downstream consequences. The single most useful step is to watch for unexpected medical bills, insurance statements, or collection notices that do not match services you received. Request your medical records from Broadway Medical Clinic periodically so you can spot any entries that do not belong to you.

Place a fraud alert with the three major credit bureaus even though financial data was not listed in the filing. A fraud alert forces lenders to verify your identity before opening new accounts and adds a visible flag that many organisations check. It is free, lasts one year, and can be renewed. Because medical identity theft sometimes leads to financial identity theft, the alert provides an inexpensive safety net.

Review every Explanation of Benefits statement from your health insurer as soon as it arrives. Dispute any claim you do not recognise immediately. Early detection is the only practical defence once personal information linked to insurance has left the clinic’s control.

Finally, be wary of unsolicited calls or messages that reference your medical history or recent visits to Broadway Medical Clinic. Legitimate organisations rarely ask for sensitive information by phone when they already possess it. When in doubt, hang up and call the clinic back using a number you look up yourself.

The filing establishes that one person’s personal information is now outside Broadway Medical Clinic’s systems. That fact cannot be undone. What can still be managed is how quickly you detect and stop any misuse of the record that now exists somewhere beyond the clinic’s walls.