Brandywine Pediatrics Alerts 27,000 to Potential ePHI Breach
Wilmington, DE-based healthcare provider Brandywine Pediatrics, P.A. has informed tens of thousands of its patients that some of their protected health information has potentially been accessed by an unknown individual. The security breach involved a computer virus, which was discovered on one of the organization’s file servers.
While it has not been explicitly stated that the virus was ransomware, Brandywine Pediatrics has informed patients that the virus rendered ePHI inaccessible. In order to regain access to files it was necessary to restore files from data backups.
The virus infection was discovered on October 25, 2016, sparking a full investigation. A third-party computer forensics expert was contracted to conduct an investigation. That investigation revealed that a number of practice files containing ePHI had potentially been accessed. Sensitive data in the files included names, addresses, medical information, and health insurance details of patients. Brandywine Pediatrics has confirmed that Social Security numbers, credit card/debit card numbers and financial data were not accessed or exposed at any point.
While data access was possible, no evidence was uncovered to suggest that files had actually been copied by the attacker, and no reports of unauthorized use or misuse have been received as of December 23.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Breach notification letters were mailed to affected patients in late December. At the time, it was unclear exactly how many individuals had been impacted by the breach as this was not stated in the breach notice. The security incident has now been added to the Department of Health and Human Services’ Office for Civil Rights Breach portal. The breach summary indicates 26,873 patients were affected.
Brandywine Pediatrics has advised patients how they can minimize risk and action has been taken to prevent similar malware and ransomware infections in the future. Policies and procedures have been reviewed and updated, and Brandywine Pediatrics is reviewing the security of its systems and improvements will be made, as appropriate.
