HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Ransomware Attacks Reported by California and Illinois Clinics

Patients of Quantum Vision Centers and Eye Surgery Center in Illinois are being notified that some of their protected health information may have been compromised in an April 2019 ransomware attack.

An unauthorized individual gained access to certain Quantum systems and deployed ransomware on April 18, 2019. The ransomware encrypted files, some of which contained information such as names, dates of birth, addresses, health insurance information, and Social Security numbers.

A third-party computer forensics firm has been hired to help determine the nature and scope of the attack. The investigation is ongoing, but it is believed that the malware was not used to steal any patient information. The sole purpose of the attack appears to have been to extort money from the business.

Encrypted files are now being recovered and backup measures have been implemented to ensure services can continue to be provided to patients, albeit with some disruption.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

It is currently unclear exactly how many patients have been affected. Affected individuals have been offered one year of credit monitoring services.

Marin Community Clinics Recovers from Ransomware Attack

Marin Community Clinics in California has experienced a ransomware attack that caused considerable disruption to its IT systems last week.

The attack occurred between 9pm and 10pm on Wednesday, June 19 and resulted in widespread file encryption. A ransom demand was issued and, after consulting with its network operator, Marin Community Clinics paid an undisclosed percentage of the ransom demand.

Computer systems were taken out of action as a result of the attack. Even with the keys to unlock the encrypted files, recovery has taken several days. All computer systems are expected to be brought back online by Saturday 22, June.

Medical services continued to be provided to patients while computer systems were down and the hospital was operating in emergency mode. Patient information was recorded on paper and will be transferred when systems are brought back online. The data recovery process is progressing and major data loss is not anticipated.

Marin Community Clinics’ CEO Mitesh Popat told the Marin Independent Journal that no patient data was compromised and major data loss is not expected; however, there may be minor data loss for certain patients as a result of the data recovery process.

It is currently unclear how the ransomware was introduced and for how long the hackers had access to its systems prior to the deployment of ransomware.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.