University Gastroenterology Reports Cyberattack
University Gastroenterology in Rhode Island has announced that one of its electronic file storage systems has been compromised. An unauthorized individual gained access to the system and succeeded in encrypting a number of files. It is unclear whether that individual issued a ransom demand to unlock the files, or whether ransomware was actually involved.
The file system contained a limited amount electronic protected health information relating to patients acquired from Consultants in Gastroenterology, a practice which was acquired by University Gastroenterology in 2014.
Upon discovery of the security breach, action was promptly taken to prevent any other systems from being accessed and an investigation was launched to determine the contents of the encrypted files. That investigation revealed that the encrypted files contained the names of patients, along with their home addresses, medical billing information, dates of birth, and Social Security numbers. Electronic health records were stored in a different system and were not exposed.
It is not clear when the files were encrypted, although the security breach was discovered on July 11, 2016. Determining which patients had been affected and confirming contact details took some time, hence the delay in issuing breach notification letters to patients.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While ePHI was potentially viewed, the investigation did not uncover any evidence to suggest that any ePHI had been obtained by any unauthorized individuals and no reports been received to suggest that data have been used inappropriately.
All patients affected by the incident have now been notified of incident by mail and have been offered identity theft protection services with Equifax for a period of 12 months.
University Gastroenterology has responded to the incident by enhancing security protections. Those measures include deactivating user accounts that are no longer in use, installing anti-malware software on all end points and servers, and removing the affected servers from the network.
