Pennsylvania Ambulatory Surgery Center Alerts 13K Patients to Ransomware Attack
Langhorne, PA-based Ambulatory Surgery Center at St. Mary has announced that it was the victim of a ransomware attack on June 1, 2016, according to the Bucks County Courier Times.
The IT department was alerted to the ransomware infection by staff members who were prevented from accessing files stored on its computer network. While other ransomware victims have been forced to give in to attacker’s demands in order to recover encrypted files, the Ambulatory Surgery Center was able to restore all affected files from a backup and did not have to resort to paying the ransom demand.
As was confirmed this week by the Department of Health and Human Services’ Office for Civil Rights, a ransomware attack on a healthcare organization requires notifications to be sent to patients to alert them to the possible disclosure of their protected health information.
The Ambulatory Surgery Center sent breach notification letters to almost 13,000 patients last week to advise them that their PHI may have been accessed. All individuals affected by the security breach have been offered credit monitoring services to allow them to monitor for any fraudulent use of their data.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
According to a statement from a spokesperson for the Ambulatory Surgery Center, the ransomware attack was unlikely to have been used as a means to gain access to patient data. “In most cases, ransomware is not utilized for the purposes of accessing personal identification information. However, since the ransomware did access our network, we need to notify you just in case other information was accessed.”
Many ransomware campaigns install malware in addition to ransomware. Data security threats can therefore remain after encrypted files have been restored from backups. It is therefore essential – and a requirement of HIPAA – to perform a full risk assessment after a ransomware infection and to audit systems to determine whether any data security risks remain.
The Ambulatory Surgery Center is in the process of conducting an internal audit to ensure that no further malware was installed and no backdoors remain which could allow the attackers to access patient data or cause any further harm or damage.
