Southeastern Minnesota Oral & Maxillofacial Surgery (SEMOMS) has made it public that a ransomware may have impacted the protected health information of almost 80,000 patients.
The attack was first discovered on September 23, 2019. The IT team reacted quickly and secured the compromised server so as to restore the encrypted data. It is not known whether the ransom was paid or if the IT team was able to bring the server back online from backups.
With the help of computer forensics specialists, SEMOMS were able to see that the impacted server included the names and X-ray images and that the server had been logged onto by an unauthorized individual. No proof was located to suggest any patient information was accessed or taken away by the hackers, but the possibility of unauthorized ePHI access and data theft could not be disregarded. Due to this, notification letters have been shared to all of those people whose protected health information was potentially infiltrated.
Healthcare Administrative Partners Phishing Campaign Attack Impacts 17,693 Clients
Healthcare Administrative Partners (HAP), a Media, PA-based provider of medical billing and coding services to healthcare centers, has found out that the email account of one of its staff members was accessed by an unauthorized person after a response to a phishing email.
The phishing attack was detected on June 26, 2019 when suspicious activity was identified in the employee’s email account. On September 26, 2019, HAP determined that the protected health information of certain clients was present in the email account.
A third-party computer forensics specialist firm was contracted to assist with the breach investigation. It was not possible to discover whether emails and email attachments including ePHI had been accessed, but the possibility could not be completely disregarded.
The account also incorporated patients’ names, addresses, birth dates, medical record numbers, physicians’ names, prescriptions, medical diagnoses, and restricted treatment information. HAP notified all impacted providers on October 4, 2019.
Measures have now been implemented to better email security. All passwords for email were amended, all external emails are now marked as external, employees are being provided with extra security awareness training, and mailbox size limits and email archiving have been put in place to reduce data exposure in the event of a further attack. HAP is also considering multi-factor authentication options.
Elizabeth Family Health Warns 28,375 Patients in Relation to Data Exposure
The Elizabeth, CO-based healthcare center, Elizabeth Family Health, is getting in touch with 28,375 patients that some of their protected health information has been infiltrated.
On September 23, 2019, Elizabeth Family Health suffered a break-in and its facilities were thrashed. The perpetrator tooka number of different items from its facilities, including server backup tape cartridges. Those cartridges contained the protected health information of patients, including names, demographic data and Social Security information.
Elizabeth Family Health has not been sent any reports of improper use of patient information but has got in touch with impacted individuals as a precaution and has provided information on the steps that can be taken to prevent their personal information from being improperly used.