HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

NCH Healthcare System Cyberattack Announced

The NCH Healthcare System cyberattack resulted in the compromising of two data center servers. Employee data were potentially accessed, but no patient health data were exposed.

The NCH Healthcare System cyberattack took place on Wednesday last week. The intrusion detection alarm was triggered, allowing the cyberattack to be rapidly identified. Access to the servers was rapidly shut down.

The Naples-based healthcare system operates the NCH Baker Hospital, formerly known as the NCH Downtown Naples Hospital, and the NCH North Naples Hospital, along with numerous clinics and outpatient centers in Naples, Florida.

The affected servers were located in a data center in Kansas City, MO. The two Cerner Data Center servers were not used to store any patient data, although they did house a medical staff credentialing database and an employee information database.

Get The Checklist

Free and Immediate Download
HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

According to statements released by a representative of the Cerner Data Center and the Director of Marketing for NCH, no patient information was stored on the servers so none of the health systems patients have been affected by the breach.

NCH has stated that medical staff and other employees affected by the breach have been advised by mail of the breach of information and have been offered identity theft monitoring services as a precaution. No reports have been received indicating data has been used inappropriately, although given the timescale between the attack and the announcement this is to be expected.

Study Shows Encryption Often Not Used for Employee Data

Healthcare organizations are right to focus on protecting patient data from hackers, but it is important to protect all sensitive data. A recent study conducted on 1,700 IT decision makers by Sophos revealed that companies are often not using encryption to protect employee data.

The study showed that 47% of companies were encrypting their most sensitive data, yet not encrypting employee information. 43% of companies were found not to be encrypting human resources files.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.