HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Family Tree Health Clinic Announces Ransomware Attack

The Family Tree Health Clinic in League City, Texas is alerting 13,402 patients that their protected health information was potentially viewed by unauthorized individuals. The attackers gained access to the IT systems of the clinic and downloaded ransomware.

The clinic reports that this was a ‘sophisticated ransomware-encryption’ attack that was quickly remediated. The attack occurred on April 24, 2017 preventing the clinic from accessing its systems. The clinic was prepared for ransomware attacks and had a backup of patients’ protected health information. All encrypted data was restored from those backups and no ransom payment was made.

The clinic has received no reports that any PHI has been misused, although data were potentially accessed by the individuals behind the attack. The types of data that could have been viewed included the patients’ names, addresses, dates of birth, Social Security numbers, medical information including claims and diagnosis codes and health insurance information. Financial information, including credit/debit card numbers, were not stored in the system and remained secured.

After PHI had been restored and the ransomware infection removed, Family Tree Health corrected the security vulnerability that allowed the attackers to gain access to its system. Steps have also been taken to prevent future ransomware attacks from occurring.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The incident was reported to the FBI and the Department of Health and Human Services’ Office for Civil Rights has now been notified of the potential data breach.

Breach notification letters were sent to all affected patients on June 19. No credit monitoring services have been offered, although patients have been provided with further information on how they can secure their accounts and monitor for fraudulent use of their information.

A spokesperson for the clinic said, “Privacy and protection of patient information is a top priority for us, and we deeply regret any inconvenience or concern this incident may cause.”

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.