391,472 Patients Impacted by Sarrell Dental Ransomware Attack
Sarrell Dental, an Alabama-based not-for-profit provider of Children’s dental and optical services, has experienced a ransomware attack in which the protected health information of its patients may have been compromised.
Sarrell Dental is the largest provider of dental services in the state of Alabama and operates 17 clinics in the state. In July 2019, ransomware was deployed on its network which resulted in widespread file encryption. Upon discovery of the attack, the network was deactivated, and an investigation was launched. Affected clinics were closed for two weeks while the breach was investigated and systems were restored. A ransom demand was received but it was not paid. Patient information was restored from backups.
A third-party computer forensics team was engaged to assist with the investigation to determine the extent of the breach. That investigation revealed that the attackers may have first gained access to Sarrell Dental systems as early as January 2019. No evidence was found to suggest patient information was accessed or copied by the attackers, but the possibility could not be ruled out. To date, no reports have been received to suggest any patient information has been misused.
The parts of the system that were potentially accessed by the attackers were discovered to contain protected health information including names, addresses, birth dates, Social Security numbers, health insurance information, treatment information, dates of service, diagnosis codes, procedure codes, and the name of the treating dentist.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The incident was reported to law enforcement and the Department of Health and Human Services’ Office for Civil Rights (OCR) has been notified. The OCR breach report indicates 391,472 patients potentially had their PHI exposed.
Sarrell Dental has since implemented additional security controls to prevent future attacks and network and system monitoring capabilities have been enhanced.
Notification letters were sent to affected patients on September 12, 2019. Affected individuals have been offered credit monitoring and identity theft protection services for 12 months at no cost.
