HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

85,000 Patients Impacted by California Ransomware Attack

Center for Orthopaedic Specialists is notifying its patients that some of their protected health information was potentially accessed by unauthorized individuals who installed ransomware on its network.

The attack impacts all current and former patients of three of its facilities in West Hills, Simi Valley and Westlake Village in California. According to Databreaches.net, 85,000 patients have potentially been impacted.

Center for Orthopaedic Specialists was notified by its IT vendor that an unauthorized individual began attempting to access its network on February 18, 2018. Access to the network was gained and ransomware was installed, which was used to encrypt a wide range of files, many of which contained the protected health information of patients. The types of information encrypted by the ransomware included names, details about medical records, dates of birth, and Social Security numbers.

Prompt action was taken by the IT vendor to limit the harm caused and the affected system was taken offline rapidly to prevent any exfiltration of data.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

An investigation into the breach has not uncovered any evidence to suggest that patients’ protected health information was viewed or copied by the individuals responsible for the attack, although data theft could not be ruled out with 100% certainty. Out of an abundance of caution, all patients whose PHI was encrypted by the ransomware have been notified of the breach to allow them to take precautions to protect against identity theft and fraud.

Even though data theft is not suspected, out of an abundance of caution, Center for Orthopaedic Specialists is offering all affected individuals identity theft protection and credit monitoring services through ID Experts for 24 months without charge. Patients will also be protected by a $1,000,000 insurance policy.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.