Malware Installed on Florida Hospital Websites May Have Provided Access to PHI
Three websites used by Florida Hospital have been infected with malware that has potentially allowed the threat actors behind the attack to obtain patients’ protected health information.
PHI access has not been confirmed and no reports have been received to suggest any protected health information has been misused. Patients are being informed of the breach and, out of an abundance of caution, have been offered complimentary credit monitoring services. The websites impacted are FloridaBariatric.com, FHOrthoInstitute.com and FHExecutiveHealth.com.
The data potentially compromised was limited and did not involve any financial information. Potentially, patients’ names, birth dates, email addresses, phone numbers, insurance carriers, the last four digits of their social security numbers, any comments uploaded via the sites, and their height and weight have potentially been obtained by the attackers. The malware attack was limited to the above websites and no other systems were affected.
It is unclear what type of malware was uploaded to the websites and how long the malware was present on the websites before it was detected. Florida Hospital released a statement on Wednesday about the malware infection and all three websites have been taken offline while the malware is removed and the sites are sanitized.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The incident has yet to be reported to the Department of Health and Human Services’ Office for Civil Rights, so it is currently unclear exactly how many patients have been impacted. All patients affected by the security breach will be notified by mail if any of their protected health information is believed to have been compromised.
Florida Hospital is taking all appropriate steps to ensure similar security breaches are prevented and vulnerabilities across all of its online networks are addressed.
