PHI of 38,000 Patients Stolen in Ransomware Attack on Reproductive Biology Associates
The Georgia fertility clinic Reproductive Biology Associates has announced it suffered a ransomware attack in April in which files containing the personal and protected health information of approximately 38,000 patients were exfiltrated by the attackers.
The attackers gained access to a file server containing embryology data on April 7, 2021, and ransomware was used to encrypt files on April 16, 2021. The files contained the PHI of patients of Reproductive Biology Associates and its affiliate My Egg Bank North America, which included full names, addresses, Social Security numbers, laboratory test results, and information related to the handling of human tissue.
The investigation into the attack concluded on June 7, 2021. While it has not been officially confirmed whether the ransom was paid, Reproductive Biology Associates said the attackers have deleted all data stolen in the attack and all encrypted data have now been recovered.
Reproductive Biology Associates has been monitoring online and dark web sites for signs of misuse or misappropriation of the stolen data and will continue to do. Affected individuals have been offered complimentary credit monitoring and identity theft protection services and a third-party cybersecurity firm has been engaged to help secure its systems and prevent further attacks.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Georgia Hospital System Suffers Ransomware Attack
St. Joseph’s/Candler (SJ/C) hospital system in Savannah, GA has announced it was the victim of a ransomware attack which occurred around 4 a.m. on Thursday June 17, 2021. The attack prevented access to computer systems and emergency protocols were implemented, with staff reverting to pen and paper to record patient data.
The attack was detected promptly and steps were taken to isolate systems to limit the damage caused; however, it is too early to tell what, if any, patient information has been affected and if the attackers exfiltrated patient data prior to using ransomware to encrypt files.
“Patient care operations continue at our facilities using established back-up processes and other downtime procedures,” explained SJ/C in a statement. “Our physicians, nurses and staff are trained to provide care in these types of situations and are committed to doing everything they can to mitigate disruption and provide uninterrupted care to our patients.”
SJ/C has now issued an update about the attack and has confirmed the PHI of 1.4 million individuals was potentially compromised. You can read more here.
UF Health Ransomware Attack Having Impact on Patient Care
On May 31, 2021, UF Health Central Florida suffered a ransomware attack that affected The Villages Regional Hospital and Leesburg Hospital. Following the attack, emergency downtime procedures were implemented and care has continued to be provided to patients, with staff recording patient information using pen and paper.
It has now been more than 2 weeks since the attack and EHR downtime procedures are still in effect while UF Health attempts to restore its systems and affected data, and the attack is now having a negative impact on patient care.
According to a recent report on WESH 2 News, employees at the affected hospitals said they are still unable to check the EHR, cannot obtain medication lists, and are unable to confirm if patients have allergies. Staff are also experiencing delays receiving lab reports. Staff at the hospital spoke to reporters and said some patients were receiving one medication when a different one was ordered, and medications that are due are missing. “God forbid that we administer something that we thought was ordered or wasn’t ordered and something happens and there is a bad outcome,” said one employee to WESH 2 News.
It is currently unclear whether UF Health intends to pay the ransom and whether patient data have been stolen. A spokesperson for UF Health was unable to confirm when systems would be restored.
