HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Fetal Diagnostic Institute of the Pacific Experiences Ransomware Attack

The Fetal Diagnostic Institute of the Pacific (FDIP) in Honolulu, HI, experienced a ransomware attack on June 30, 2018. File-encrypting software was installed on an FDIP server and encrypted a wide range of file types, including patient medical records.

FDIP engaged the services of a leading cybersecurity company to conduct a full investigation into the breach to determine whether patient data was accessed by the attackers and also to assist with breach remediation. The investigation did not uncover any evidence to suggest that patients’ protected health information was accessed, viewed, or stolen by the individuals behind the attack, although it was not possible to rule out data access and data theft with a high level of confidence.

Consequently, the incident is being treated as a HIPAA breach, patients are being notified, and the Department of Health and Human Services’ Office for Civil Rights (OCR) has been informed.

An analysis of the files encrypted by the ransomware revealed they contained a range of protected health information. Patients affected by the security breach may have had their full name, home address, date of birth, account number, diagnoses, and “other types of information” exposed. No financial information was exposed as a result of the attack. The breach report submitted to OCR indicates 40,800 current and former patients have been affected by the breach.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

FDIP reports that prompt action was taken to address the breach and remove the malicious software and restore all encrypted files. Its systems have now been cleansed and no trace of any malware remains. Steps have also been taken to improve security protections to prevent any further security breaches and unauthorized disclosures of patient data.

FDIP does not expect patients to experience any harm as a result of the ransomware attack, although patients have been urged to get in touch with FDIP immediately if they become aware of any suspicious activity that they believe is related to the breach.

This is only the fifth data breach of more than 500 records to have been reported to OCR by a Hawaii-based covered entity since data breach summaries first started being published by OCR in 2009.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.