HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

107,000 Ferguson Medical Group Patients Impacted by Ransomware Attack

Saint Francis Healthcare System has announced that the computer network of Ferguson Medical Group has been attacked with ransomware.

The attack occurred on September 21, 2019, before Saint Francis Medical Center acquired the Sikeston, MO-based medical group. Saint Francis Healthcare learned about the ransomware attack on September 21.

According to a notice on the Saint Francis Healthcare website, the attackers succeeded in encrypting medical records of all patients who had received medical services at Ferguson Medical Group prior to January 1, 2019. The incident was reported to the Federal Bureau of Investigation and steps were immediately taken to isolate the affected systems.

The attackers demanded payment of a ransom for the keys to decrypt files on the network. Since there was no guarantee that the attackers were able to supply working decryption keys and due to other uncertainties, the decision was taken not to pay and to instead recover files from backups.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

While many files were recovered, some information could not be restored and has been permanently lost. It was not possible to recover any documentation that had been scanned and saved on its systems, and medical records for patients who received services at Ferguson Medical Group between September 20, 2018 and December 31, 2018 were also permanently lost.

An analysis of the attack uncovered no evidence to suggest the attackers obtained files containing the protected health information of patients prior to encryption and there have been no reports received to suggest any patent information has been misused. However, since it is not possible to rule out unauthorized data access and theft, affected patients have been offered complimentary credit monitoring and identity theft protection services.

The incident has been listed on the Department of Health and Human Services’ Office for Civil Rights breach portal. The breach summary indicates 107,054 Ferguson Medical Group patients have been affected. It is not clear how many of those patients have had some or all of their health information lost as a result of the attack.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.