HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

3,700 Rise Wisconsin Plan Participants Potentially Impacted by Ransomware Attack

Rise Wisconsin is alerting more than 3,700 plan members that some of their protected health information was potentially accessed by unauthorized individuals during a recent ransomware attack.

The ransomware was installed on its network on or around April 8, 2018. The ransomware attack was detected rapidly, although not in time to prevent the encryption of data.

Rise Wisconsin (formerly Community Partnerships Inc., and Center for Families) called in third party computer forensics experts to assist with the breach investigation and recovery process. While the investigation did not uncover any evidence to suggest protected health information was accessed or stolen in the attack, it was not possible to rule out data access and data theft with a high degree of certainty.

Potentially, the types of data that could have been accessed by the attackers includes names, addresses, dates of birth, Social Security numbers and, for certain patients, a limited amount of health information.  No financial information was compromised.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Rise Wisconsin has not disclosed how much the attackers demanded for the security keys to unlock the encrypted data or whether that ransom demand was paid.

Rise Wisconsin takes the security of health information very seriously and had implemented a range of security controls to prevent the unauthorized accessing of PHI. In this case those controls proved insufficient; however, steps have now been taken to enhance security and prevent further incidents of this nature from occurring. Those steps include placing further restrictions on network access and increasing staff information security awareness training.

The incident has been reported to appropriate authorities and law enforcement is investigating the attack. The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 3,731 plan members have been impacted by the incident.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.