Malware Attack Results in Corruption of Medical Records: 30,000 Patients Affected
On November 21, 2019, Fondren Orthopedic Group, an association of private orthopedic surgery practitioners in Houston and the surrounding areas, experienced a cyberattack that affected certain parts of its IT system.
In a substitute breach notice posted on its website, the incident was described as a malware attack that damaged the medical records of certain patients. Prompt action was taken to contain the infection and its systems were restored; however, the medical records corrupted by the malware could not be recovered and have been permanently lost.
The corrupted records included patients’ names, addresses, telephone numbers, health insurance information, and diagnosis and treatment information. All patients affected by the incident were current or former patients of Dr. K. Matthew Warnock.
Third party forensic investigators were engaged to assist with the investigation and found no evidence of unauthorized data access or exfiltration of data. Fondren Orthopedic Group is reviewing data security policies and procedures and will be enhancing its security protocols to improve resilience to malware attacks. Affected patients have been notified and informed that they will need to complete new patient forms and supply details of their medical histories when they next visit Dr. Warnock.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The cyberattack has been reported to the HHS’ Office for Civil Rights. The breach summary shows up to 30,049 patients have been affected.
Access Health CT Notifies 1,100 About Unspecified Data Breach
Access Health CT, the health insurance marketplace in Connecticut, has notified approximately 1,100 consumers that some of their protected health information was exposed in a data breach.
In its substitute breach notice, Access Health CT apologized for any inconvenience caused by the breach and said affected individuals have been offered free access to services to help them protect their personal information. The breach notice did not explain the nature of the breach, when it occurred, nor the types of information that were compromised.
The notice states, “Several efforts to improve security are already in place, with longer-term initiatives planned regarding system changes and more frequent Information Technology (IT) security training to improve data protection and security awareness.”
