Family Tree Health Clinic Announces Ransomware Attack
The Family Tree Health Clinic in League City, Texas is alerting 13,402 patients that their protected health information was potentially viewed by unauthorized individuals. The attackers gained access to the IT systems of the clinic and downloaded ransomware.
The clinic reports that this was a ‘sophisticated ransomware-encryption’ attack that was quickly remediated. The attack occurred on April 24, 2017 preventing the clinic from accessing its systems. The clinic was prepared for ransomware attacks and had a backup of patients’ protected health information. All encrypted data was restored from those backups and no ransom payment was made.
The clinic has received no reports that any PHI has been misused, although data were potentially accessed by the individuals behind the attack. The types of data that could have been viewed included the patients’ names, addresses, dates of birth, Social Security numbers, medical information including claims and diagnosis codes and health insurance information. Financial information, including credit/debit card numbers, were not stored in the system and remained secured.
After PHI had been restored and the ransomware infection removed, Family Tree Health corrected the security vulnerability that allowed the attackers to gain access to its system. Steps have also been taken to prevent future ransomware attacks from occurring.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The incident was reported to the FBI and the Department of Health and Human Services’ Office for Civil Rights has now been notified of the potential data breach.
Breach notification letters were sent to all affected patients on June 19. No credit monitoring services have been offered, although patients have been provided with further information on how they can secure their accounts and monitor for fraudulent use of their information.
A spokesperson for the clinic said, “Privacy and protection of patient information is a top priority for us, and we deeply regret any inconvenience or concern this incident may cause.”
