Seguin Dermatology Announces Ransomware Attack: ePHI Access Likely
Texas-based Seguin Dermatology has started informing patients of a ransomware attack that has likely resulted in electronic protected health information (ePHI) being inappropriately accessed.
The attack occurred on or around September 12, 2016 and involved a server used by the office of Robert J. Magnon, M.D. The ransomware encrypted numerous file types preventing data access. While the server was not used to store electronic medical records, some ePHI was in the encrypted files.
Upon discovery of the ransomware attack, Seguin Dermatology contacted an external IT firm which was able to remove the ransomware and restore data from backups. A thorough forensic analysis of the affected server was performed to determine the extent of the attack and whether patient data had been compromised. The IT firm concluded that there was a high likelihood that the attackers accessed the ePHI of patients. The firm was unable to confirm whether patient data had been stolen, although the possibility could not be ruled out.
Financial data including credit and debit cards were not encrypted and remained secure and no medical records nor laboratory reports were compromised. However, the server did contain files which included patients’ names, addresses, telephone numbers, demographic information, insurance billing information, Current Procedural Technology (CPT) codes, dates of birth, and in some cases, Social Security numbers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Seguin Dermatology acted promptly and started notifying patients of the incident within three weeks of the conclusion of the investigation, well within the time frame stipulated by the Health Insurance Portability and Accountability Act’s Breach Notification Rule.
A thorough review of physical and computer security is being conducted and steps will be taken to improve security to prevent future incidents from occurring. Policies and procedures are also being revised and staff at Seguin Dermatology will receive further training on security awareness. Patients have been offered identity theft and credit monitoring services for 12 months to protect them against fraud.
