Fondren Orthopedic Group, an association of private orthopedic surgery practitioners in Houston and the surrounding areas, experienced a cyberattack that affected certain parts of its IT system on November 21, 2019.
In a substitute breach notice published on its website, the incident was referred to as a malware attack that damaged the medical records of specific patients. Quick action was taken to limit the infection and its systems were restored; however, the medical records corrupted by the malware could not be rescued and have been forever lost.
The corrupted records included patients’ names, addresses, telephone numbers, health insurance data, and diagnosis and treatment details. All patients impacted by the incident were existing or former patients of Dr. K. Matthew Warnock.
Externally-hired forensic investigators were brought in to assist with the investigation and found no evidence of unauthorized data access or exfiltration of data. Fondren Orthopedic Group is looking over data security policies and procedures and will be bolstering its security protocols to improve resilience to malware attacks. Impacted patients have been notified and advised that they will need to complete new patient forms and supply details of their medical histories when they next attend Dr. Warnock.
The cyberattack has been made known to the HHS’ Office for Civil Rights. The breach summary shows up to 30,049 patients have been impacted.
Access Health CT Informs 1,100 Clients About Unspecified Data Breach
Access Health CT, the health insurance marketplace in Connecticut, has notified around 1,100 members that some of their protected health information was exposed in a data breach.
In its substitute breach notice, Access Health CT said sorry for any inconvenience caused by the breach and said affected people have been offered complimentary access to services to help them protect their personal data. The breach notice did not explain the extent of the breach, when it took place, nor the types of information that were impacted.
The notice says, “Several efforts to improve security are already in place, with longer-term initiatives planned regarding system changes and more frequent Information Technology (IT) security training to improve data protection and security awareness.”