HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Seton Healthcare Family Hospitals Targeted by Cybercriminals

Ascension Health, which runs the Seton Healthcare Family hospital network in Austin, TX, announced earlier this week that a computer virus had been discovered on its computer network. The hospital network was alerted to a potential cyberattack on Sunday when ‘suspicious activity’ was detected on the network.

In response to the suspected cyberattack, Seton Healthcare shut down around 3,600 devices as a precautionary measure while the incident was investigated. The suspicious activity was attributed to a virus, although no details have been released on the nature of the malware.

IT teams worked quickly to remove the virus and secure its network. The computer systems used by Dell Seton Medical Center and Dell Children’s Medical Center were quickly restored, although Seton Medical Center Williamson and Seton Medical Center Hays continued to be impacted by the incident until Wednesday, May 31. The Seton Smithville Regional Clinic and Seton Shoal Creek facility were unaffected.

The fast response by Seton Healthcare reduced the impact of the cyberattack. Staff had been drilled to expect incidents such as this and policies and procedures could be quickly implemented in case of malware, ransomware or hacking incidents. As this incident shows, healthcare organizations need to be prepared for security incidents and have the capability to respond rapidly.

Please see the HIPAA Journal Privacy Policy

A statement about the incident was issued earlier this week by Ascension Health confirming there were “no patient safety issues” and “no devices have been reported as encrypted by ransomware.” Systems were shut down as a safety precaution, with staff members moving to paper records while systems were down and the virus was removed. Ascension Health said “The attempt was unsuccessful, so no data was encrypted or lost.”

Out of an abundance of caution, emergency medical services were instructed to redirect some patients to other hospitals during the seven hours that the systems were down on Sunday night out of safety concerns. Additional members of staff were also called in to ensure patient safety was not affected.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.