Ransomware Attack Impacts 6,550 Jemison Internal Medicine Patients
On December 20, 2017, a ransomware attack on Jemison Internal Medicine of Alabama resulted in electronic health records being encrypted, preventing the healthcare provider from gaining access to patient data.
A ransom demand was issued for the keys to unlock the encryption although no payment was made to the attacker. Jemison Internal Medicine had viable backups of electronic protected health information and restored data after reinstalling the operating system on affected computers. An analysis of its system post-data restoration revealed no traces of the malicious software remained.
While ransomware attacks are often indiscriminate and occur as a result of employees responding to phishing emails, this attack was more targeted. The investigation into the security breach revealed an unauthorized individual had gained access to Jemison Internal Medicine’s computer system and had access for a period of approximately 3 months.
The investigation did not uncover any evidence to suggest the EMR system was accessed by the attacker, although it was not possible to rule out data access with a high degree of certainty. The types of information that could potentially have been viewed or copied include names, telephone numbers, dates of birth, addresses, Social Security numbers, driver’s license numbers, prescription information, health insurance details, and treatment and procedure information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The incident has prompted Jemison Internal Medicine to conduct a review of security, policies, and procedures and steps have been taken to secure its systems and prevent further attacks. Remote connectivity to its computers has been disabled, all passwords have been changed, and other measures have been implemented to strengthen security.
Patients affected by the security breach have now been notified by mail and the incident has been reported to the Department of Health and Human Service’ Office for Civil Rights. The OCR breach summary indicates the protected health information of 6,650 patients was potentially compromised.
