HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

PHI of 127,000 NorthCare Patients Potentially Compromised in Ransomware Attack

NorthCare, an Oklahoma City, OK-based mental health clinic, was the victim of a ransomware attack in June 2021 in which patients protected health information may have been compromised.

NorthCare identified suspicious network activity on June 1, 2021, when ransomware was used to encrypt files. The investigation into the attack confirmed its network was breached on May 29, 2021. The attackers rapidly deployed ransomware to prevent access to files and demanded payment of a ransom for the keys to decrypt files.

Steps were immediately taken to contain the attack and while it was not possible to prevent file encryption, it was possible to restore its systems and data from backups without paying the ransom.

The parts of the network accessed by the attackers contained patients’ protected health information. While data exfiltration was not confirmed, NorthCare is assuming the attackers accessed patient data. The types of data potentially compromised in the attack included full names, addresses, dates of birth, medical diagnoses, and Social Security numbers.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Following the attack, third-party forensics experts were engaged to assist with the investigation and remediation efforts, the Federal Bureau of Investigation was notified, and NorthCare has been working with technical experts to improve the security of its systems and limit network access.

Since protected health information was potentially accessed and obtained, NorthCare has offered identity monitoring, fraud consultation, and identity theft restoration services to affected individuals for 12 months at no cost.

The breach notification sent to the Maine attorney general indicates the protected health information of 127,883 patients was potentially compromised.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.