HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

7,000 Patients Notified About Pawnee County Memorial Hospital Malware Attack

Pawnee County Memorial Hospital in Pawnee City, Nebraska, is alerting 7,038 patients that some of their protected health information has potentially been accessed by a hacker.

On November 29, 2018, the hospital learned that malware had been installed which allowed an unauthorized individual to gain access to its email system.

Malware was injected into the hospital’s email system when an employee opened a malicious email attachment. According to Pawnee County Memorial Hospital’s substitute breach notice, the email appeared to have been sent from a trusted source and the email attachment seemed genuine.

Assisted by a third-party computer forensics expert, the hospital determined that the email attachment had been opened on November 16, 2018. The hacker was able to access employees’ email accounts from November 16 to November 24.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

The compromised email accounts contained a range of business reports, clinical reports, clinical summaries, and other internal documents. Those documents contained patients’ full names along with one or more of the following data elements: Date of birth, address, diagnosis, lab test results, medical record number, insurance information, state ID number, driver’s license number and, for a limited number of patients, Social Security number.

While PHI access was possible, it is unclear whether the hacker viewed or obtained any patient information. The hospital believes the attack was financially motivated and was not conducted with the aim of stealing patient information.

In response to the breach, the hospital reset all passwords on employee email accounts and additional technology safeguards are being implemented to improve email security.

The hospital has sent breach notification letters to all patients whose PHI was exposed and has offered complimentary enrollment in the MyTrueIdentity online credit monitoring service for 12 months.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.