Estill County Chiropractic Patients Impacted by Ransomware Attack
On January 17, 2017, Irvine, KY-based Estill County Chiropractic discovered its computer system had been breached by an unauthorized individual who encrypted files with ransomware .
An external computer consultant was hired to conduct a thorough investigation of the incident to determine how the ransomware was installed and the extent of the attack.
While many ransomware infections occur as a result of an employee responding to a malicious spam email message, in this case, the attacker was discovered to have previously gained access to Estill County Chiropractic’s computer system. Access to the system was first gained on January 6, 2017, although the ransomware was not installed until January 17.
Due to the nature of the attack, it is possible the attacker gained access to the protected health information of patients and stole patient data. The information potentially accessed included patients’ names, addresses, phone numbers, email addresses, dates of birth, clinical information, Social Security numbers, medical diagnoses, provider notes, claims information and health plan identification numbers. The investigation did not uncover any evidence to suggest that patients’ PHI had been accessed or stolen, although the possibility could not be ruled out.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Estill County Chiropractic is currently notifying affected patients that their PHI has potentially been compromised. Patients have been told that cybersecurity protections were already in place, although in response to the attack the chiropractic center’s systems have been replaced and additional security measures have been deployed to prevent future attacks.
The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 5,335 patients have been impacted by the attack. Estill County Chiropractic is offering all affected patients 12 months of credit monitoring services free of charge through Equifax Personal Solutions to protect them against fraud and identity theft. Patients have been advised to exercise caution and to be vigilant to the possibility that their PHI may have been used for nefarious purposes.
