Ransomware Infection Reported by Professional Dermatology Care P.C.
Another healthcare organization has been targeted with ransomware. Reston, VA-based Professional Dermatology Care P.C. (PDC) is in the process of alerting patients to a potential breach of protected health information following a ransomware attack on its network. The PHI of 13,237 patients was encrypted by the ransomware.
The attack was discovered on June 27, 2016 and action was immediately taken to prevent any further data access. PDC conducted a thorough forensic analysis of its computer system and discovered that access to its network server was first gained on June 19, 2016. The attackers potentially had access to patient data for a period of 9 days.
Breach notification letters are now being mailed to patients explaining that full names, addresses, birth dates, Medicare numbers, Social Security numbers, billing records, and medical records were all potentially accessed by the attackers. PDC points out in its breach notice that the attack is believed to have been performed to extort money from the company, rather than with the intention of stealing patient data.
Now that the infection has been removed and systems have been secured, PDC has implemented a number of new security controls to prevent future ransomware attacks. These include the installation of a new firewall and an anti-malware solution. PDC pointed out in the breach notice that this is the first time in 10 years of using electronic medical records that such a breach has occurred.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Ransomware attacks have been reported by numerous healthcare organizations so far this year. Now that the Department of Health and Human Services’ Office for Civil Rights has confirmed that ransomware infections are usually reportable breaches, it is likely that many more healthcare organizations will make similar announcements over the coming weeks.
Ransomware attacks must be reported to the OCR unless there is a low probability that PHI was compromised in the attack. If the decision is taken not to report the attack to the OCR or to notify patients, covered entities must be able to demonstrate that there was a low probability that PHI was compromised.
