HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Malware Attack Results in Corruption of Medical Records: 30,000 Patients Affected

On November 21, 2019, Fondren Orthopedic Group, an association of private orthopedic surgery practitioners in Houston and the surrounding areas, experienced a cyberattack that affected certain parts of its IT system.

In a substitute breach notice posted on its website, the incident was described as a malware attack that damaged the medical records of certain patients. Prompt action was taken to contain the infection and its systems were restored; however, the medical records corrupted by the malware could not be recovered and have been permanently lost.

The corrupted records included patients’ names, addresses, telephone numbers, health insurance information, and diagnosis and treatment information. All patients affected by the incident were current or former patients of Dr. K. Matthew Warnock.

Third party forensic investigators were engaged to assist with the investigation and found no evidence of unauthorized data access or exfiltration of data. Fondren Orthopedic Group is reviewing data security policies and procedures and will be enhancing its security protocols to improve resilience to malware attacks. Affected patients have been notified and informed that they will need to complete new patient forms and supply details of their medical histories when they next visit Dr. Warnock.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The cyberattack has been reported to the HHS’ Office for Civil Rights. The breach summary shows up to 30,049 patients have been affected.

Access Health CT Notifies 1,100 About Unspecified Data Breach

Access Health CT, the health insurance marketplace in Connecticut, has notified approximately 1,100 consumers that some of their protected health information was exposed in a data breach.

In its substitute breach notice, Access Health CT apologized for any inconvenience caused by the breach and said affected individuals have been offered free access to services to help them protect their personal information. The breach notice did not explain the nature of the breach, when it occurred, nor the types of information that were compromised.

The notice states, “Several efforts to improve security are already in place, with longer-term initiatives planned regarding system changes and more frequent Information Technology (IT) security training to improve data protection and security awareness.”

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.