HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Ransomware Attack on Finger Lakes Health Cripples Computers

Geneva, NY-based Finger Lakes Health has experienced a ransomware attack that has crippled its computer system. Staff have been forced to work on pen and paper while the health system attempts to remove the malware and restore access to electronic data.

The ransomware attack on the health system started at around midnight on Sunday March 18, 2018, with staff becoming aware of the attack when a ransom demand was issued by the attackers.

Finger Lakes Health operates Geneva General Hospital and Soldiers & Sailors Memorial Hospital in Pen Yan and several specialty care practices, primary care physician practices, long-term health facilities, and day care centers in upstate New York. It is unclear exactly how many facilities have been impacted by the ransomware attack.

Finger Lakes Health has developed emergency procedures for attack scenarios such as this, which were immediately implemented when the attack was discovered. On March 20, the health system issued a statement to local media channels about the attack explaining that while some of its information systems were inaccessible, its manual downtime protocol had been implemented and its hospitals and care facilities continued to function. Such an attack will naturally have an impact on the provision of medical services, although patient care remains the main priority while the ransomware attack is mitigated.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Finger Lakes Health is working closely with law enforcement and IT teams to restore access to data and bring its systems back online. At this stage it appears that the attackers have only encrypted data. There is no indication that any patient or employee information has been compromised.

No information on the type of ransomware used in the attack has been released and it is not clear exactly how much was demanded by the attackers to supply the keys to unlock the encryption, although Finger Lakes Health’s vice president of community services, Lara Turbide, has confirmed that the ransom was paid. “We made this decision in the interest of patient and resident care to minimize patient inconvenience and to move past this incident as quickly as possible,” said Turbide.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.