4000 Michigan Chiropractic Patients Notified of Potential Data Breach
4,082 patients of Complete Chiropractic & Bodywork Therapies (CCBT) of Ann Arbor, MI., have been notified of a potential breach of protected health information after malware was discovered on one of the company’s servers.
The malware was discovered on March 19, 2016., after the server malfunctioned. The malfunctioning of the server triggering CCBT’s security protocols which included isolating the server, blocking Internet access, and changing all workstation and third party passwords. CCBT also installed an additional firewall as an extra precaution.
External forensics experts were brought in to investigate the security incident. Their investigation revealed malware had been installed which scanned the network for passwords and login information and transmitted sensitive data to the hacker(s) command and control server.
The server stored patient data including treatment and billing information, in addition to encrypted medical record data. Encrypted information included patient names, addresses, dates of birth, health and diagnosis information, and Social Security numbers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The malware had been installed on the server four months to the day before the infection was detected and access was blocked. The forensic analysis did not uncover any evidence to suggest that patient data had actually been exfiltrated, and no reports have been received to suggest that patient data have been used inappropriately. However, CCBT and the forensics company were unable to rule out the possibility that data had been accessed.
All affected patients have now been notified of the potential data breach. A year of identity theft protection services have been offered to patients out of an abundance of caution to prevent financial harm or loss.
CCBT already employed a number of safeguards to prevent unauthorized accessing of data, including encryption, although additional security controls will now be added to further protect patient data. CCBT has also employed a new team of skilled IT professionals with experience in implementing safeguards in line with HIPAA regulations to reduce the risk of further attacks being successful.
