NCH Healthcare System Cyberattack Announced
The NCH Healthcare System cyberattack resulted in the compromising of two data center servers. Employee data were potentially accessed, but no patient health data were exposed.
The NCH Healthcare System cyberattack took place on Wednesday last week. The intrusion detection alarm was triggered, allowing the cyberattack to be rapidly identified. Access to the servers was rapidly shut down.
The Naples-based healthcare system operates the NCH Baker Hospital, formerly known as the NCH Downtown Naples Hospital, and the NCH North Naples Hospital, along with numerous clinics and outpatient centers in Naples, Florida.
The affected servers were located in a data center in Kansas City, MO. The two Cerner Data Center servers were not used to store any patient data, although they did house a medical staff credentialing database and an employee information database.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
According to statements released by a representative of the Cerner Data Center and the Director of Marketing for NCH, no patient information was stored on the servers so none of the health systems patients have been affected by the breach.
NCH has stated that medical staff and other employees affected by the breach have been advised by mail of the breach of information and have been offered identity theft monitoring services as a precaution. No reports have been received indicating data has been used inappropriately, although given the timescale between the attack and the announcement this is to be expected.
Study Shows Encryption Often Not Used for Employee Data
Healthcare organizations are right to focus on protecting patient data from hackers, but it is important to protect all sensitive data. A recent study conducted on 1,700 IT decision makers by Sophos revealed that companies are often not using encryption to protect employee data.
The study showed that 47% of companies were encrypting their most sensitive data, yet not encrypting employee information. 43% of companies were found not to be encrypting human resources files.
