HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Ransomware Attack Impacts 6,550 Jemison Internal Medicine Patients

On December 20, 2017, a ransomware attack on Jemison Internal Medicine of Alabama resulted in electronic health records being encrypted, preventing the healthcare provider from gaining access to patient data.

A ransom demand was issued for the keys to unlock the encryption although no payment was made to the attacker. Jemison Internal Medicine had viable backups of electronic protected health information and restored data after reinstalling the operating system on affected computers. An analysis of its system post-data restoration revealed no traces of the malicious software remained.

While ransomware attacks are often indiscriminate and occur as a result of employees responding to phishing emails, this attack was more targeted. The investigation into the security breach revealed an unauthorized individual had gained access to Jemison Internal Medicine’s computer system and had access for a period of approximately 3 months.

The investigation did not uncover any evidence to suggest the EMR system was accessed by the attacker, although it was not possible to rule out data access with a high degree of certainty. The types of information that could potentially have been viewed or copied include names, telephone numbers, dates of birth, addresses, Social Security numbers, driver’s license numbers, prescription information, health insurance details, and treatment and procedure information.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The incident has prompted Jemison Internal Medicine to conduct a review of security, policies, and procedures and steps have been taken to secure its systems and prevent further attacks. Remote connectivity to its computers has been disabled, all passwords have been changed, and other measures have been implemented to strengthen security.

Patients affected by the security breach have now been notified by mail and the incident has been reported to the Department of Health and Human Service’ Office for Civil Rights. The OCR breach summary indicates the protected health information of 6,650 patients was potentially compromised.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.