HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

PHI of 29,000 Patients Potentially Compromised in McAllen Surgical Specialty Center Ransomware Attack

McAllen Surgical Specialty Center in Texas has started notifying patients about a ransomware attack that was detected on May 14, 2021.

Third-party computer forensics specialists were engaged to investigate the breach and determine the nature and scope of the attack. The investigators determined unauthorized individuals had gained access to certain computers and servers on May 12, 2021 and deployed ransomware. Unauthorized access to its network was blocked on May 14.

A comprehensive analysis was conducted to determine the servers and computers that had been affected, and which had potentially been accessed by the hackers. On July 22, it was determined patient data had potentially been compromised in the attack.

The affected computers and servers contained a range of patient information, with the types of exposed data varying from patient to patient. Data potentially affected included names, addresses, Social Security numbers, dates of service, health insurance information, provider name, patient numbers, and medical record numbers.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

No evidence of data theft was identified and McAllen Surgical said in its September 20, 2021 substitute breach notice that it is unaware of any instances of actual or attempted misuse of patient data; however, affected employees and patients have been advised to be vigilant and monitor their accounts and explanation of benefit statements for signs of fraudulent activity. Notifications started to be mailed to affected patients on September 20, 2021.

McAllen Surgical said it will be reviewing and enhancing its existing policies and procedures to prevent further privacy breaches. The ransomware attack has been reported to the Department of Health and Human Services’ Office for Civil Rights as affecting 29,227 individuals.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.