HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Ransomware Attacks Impact First Impressions Orthodontics, Kids First Dentistry & Orthodontics, and Hendrick Health Patients

First Impressions Orthodontics, a subsidiary of Professional Dental Alliance of Connecticut PLLC, experienced a ransomware attack on September 28, 2020 that potentially saw the protected health information of 23,000 patients accessed by the attackers.

Backups were regularly performed and stored securely, so patient data could be recovered without having to pay the ransom. In addition to the 23,000 First Impressions Orthodontics patients, 5,000 patients of Kids First Dentistry & Orthodontics who had x-rays performed at First Impressions Orthodontics were also impacted by the breach.

The types of data potentially compromised included names, addresses, telephone numbers, email addresses, contact telephone numbers, Social Security numbers, dental insurance numbers, dental records, dental images, service charge amounts, and payments received for services provided. Patients who only had their x-ray images compromised only had their name, date of birth, and insurance information exposed.

Affected individuals were notified in accordance with HIPAA requirements, but no evidence of data access, theft, or misuse were found. Out of an abundance of caution, affected individuals have been offered a complimentary 2-year membership to credit monitoring and identity theft protection services.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Suspected Ransomware Attack Forces Hendrick Health into EHR Downtime Procedures

Hendrick Health in Texas has experienced a cyberattack that has forced it to take its IT network and EHR offline while the threat is remediated. The suspected ransomware attack occurred on November 9, 2020 and affected Hendrick Health’s medical center on the main campus and some of its clinics. Hendrick Medical Center Brownwood and Hendrick Medical Center South were not affected by the attack.

Hendrick Health said patient care was not affected and inpatient services were continuing; however, some patients were redirected to alternative campuses for medical care while the attack was remediated, and some outpatient services had to be rescheduled.

Hendrick Health is working around the clock to restore its systems. In the meantime, staff have switched to pen and paper to record patient information. The breach has been reported to the HHS’ office for Civil Rights as involving the PHI of 640,436 patients.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.