Amherst, N.Y.-based Excelsior Orthopaedics suffered a data breach affecting about 357,000 people.
The practice detected unusual activity on its network in June, contained the breach and initiated an investigation, according to a Jan. 3 statement. Patients were notified in August and December as investigators mined data to identify those affected.
The practice has since deployed new security tools for its platform.
Law firm Lynch Carpenter is investigating claims against the practice and said about 357,000 people may have had their data exposed, according to a Jan. 8 news release.