HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Seguin Dermatology Announces Ransomware Attack: ePHI Access Likely

Texas-based Seguin Dermatology has started informing patients of a ransomware attack that has likely resulted in electronic protected health information (ePHI) being inappropriately accessed.

The attack occurred on or around September 12, 2016 and involved a server used by the office of Robert J. Magnon, M.D. The ransomware encrypted numerous file types preventing data access. While the server was not used to store electronic medical records, some ePHI was in the encrypted files.

Upon discovery of the ransomware attack, Seguin Dermatology contacted an external IT firm which was able to remove the ransomware and restore data from backups. A thorough forensic analysis of the affected server was performed to determine the extent of the attack and whether patient data had been compromised. The IT firm concluded that there was a high likelihood that the attackers accessed the ePHI of patients. The firm was unable to confirm whether patient data had been stolen, although the possibility could not be ruled out.

Financial data including credit and debit cards were not encrypted and remained secure and no medical records nor laboratory reports were compromised. However, the server did contain files which included patients’ names, addresses, telephone numbers, demographic information, insurance billing information, Current Procedural Technology (CPT) codes, dates of birth, and in some cases, Social Security numbers.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Seguin Dermatology acted promptly and started notifying patients of the incident within three weeks of the conclusion of the investigation, well within the time frame stipulated by the Health Insurance Portability and Accountability Act’s Breach Notification Rule.

A thorough review of physical and computer security is being conducted and steps will be taken to improve security to prevent future incidents from occurring. Policies and procedures are also being revised and staff at Seguin Dermatology will receive further training on security awareness. Patients have been offered identity theft and credit monitoring services for 12 months to protect them against fraud.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.