HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Ransomware Attack on Salina Family Healthcare Impacts 77,000 Patients

In June, ransomware was installed on servers and workstations at Salina Family Healthcare in Kansas resulting in the encryption and potential disclosure of patients’ protected health information.

The attack occurred on June 18, 2017. Salina Family Healthcare was able to limit the extent of the attack by taking swift action to secure its systems. It was also possible to restore the encrypted data from recent backups so no ransom needed to be paid.

A third-party computer forensics firm was contracted to analyze its systems to determine how the ransomware was installed and whether the attackers succeeded in gaining access to or stealing patient data. While evidence of data theft was not uncovered, the firm was unable to rule out the possibility that the actors behind the attack viewed or copied patient data.

The protected health information potentially accessed includes names, addresses, dates of birth, Social Security numbers, medical treatment information, and health insurance details.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

While data access was possible, no reports have been received to suggest any information has been stolen and misused, although patients should be alert to the possibility of data theft and should monitor their accounts and Explanation of Benefits statements closely for any sign of fraudulent activity.

Patients potentially impacted by the attack have now been notified of the security breach and have been offered credit monitoring and identity theft restoration services for 12 months without charge out of an abundance of caution.

Salina Family Healthcare has already taken a number of steps to improve security following the ransomware attack. Those measures include upgrading network servers, regularly scanning the network for viruses, providing the workforce with additional security training on malware threats, and limiting Internet access for staff to reduce exposure.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 77,337 patients and payment guarantors have potentially been impacted by the security incident.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.