Saint Pete MRI Discloses Data Breach Exposing Patient Information

Saint Pete MRI, a diagnostic imaging and sleep lab in St. Petersburg, Florida, disclosed a data breach that may have involved the personal and protected health information of patients.

The breach was disclosed to the Vermont Attorney General on July 22, 2026, with nine Vermont residents identified as affected. Saint Pete MRI began notifying potentially impacted individuals on that same date and posted a substitute notice on its website for those whose contact information could not be identified.

On or around Feb. 23, 2025, Saint Pete MRI detected suspicious activity on its network. A forensic investigation that followed confirmed that the company's electronic patient care and imaging systems were not accessed during the incident. However, the investigation found that certain scanned data may have been acquired without authorization.

Following the initial forensic review, a separate comprehensive review of the affected files was conducted to determine what personal information they contained. On April 7, 2026, more than 13 months after the suspicious activity was first detected, that review determined that certain personal information may have been included in the affected data.

The company then worked to verify the identities of potentially affected individuals, gather and validate their contact information and assess the full scope of impacted data. According to the company's notification, this verification process was completed on July 15, 2026, roughly 17 months after the initial discovery.

The types of information that may have been involved in the breach include names, Social Security numbers, dates of birth, driver's license numbers or state identification numbers, medical information and health insurance information.

This combination includes both personally identifiable information and protected health information covered under federal health privacy laws.

Saint Pete MRI's response

Saint Pete MRI sent notification letters to potentially impacted individuals via U.S. First-Class Mail. For those whose contact information could not be identified, the company posted a substitute notice on its website. The company also notified the U.S. Department of Health and Human Services Office for Civil Rights about the incident.

In its notification, the company stated: "The privacy and security of our patient data is of utmost importance to us, and we deeply regret any concern or inconvenience this incident may cause." Saint Pete MRI also noted that it currently has no evidence to suggest any misuse or attempted misuse of the affected information.

Saint Pete MRI established a toll-free call center for individuals who have questions about the incident or related concerns. The call center can be reached at 1-877-396-3217 and is available Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Time, excluding major U.S. holidays.