HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

University Gastroenterology Reports Cyberattack

University Gastroenterology in Rhode Island has announced that one of its electronic file storage systems has been compromised. An unauthorized individual gained access to the system and succeeded in encrypting a number of files. It is unclear whether that individual issued a ransom demand to unlock the files, or whether ransomware was actually involved.

The file system contained a limited amount electronic protected health information relating to patients acquired from Consultants in Gastroenterology, a practice which was acquired by University Gastroenterology in 2014.

Upon discovery of the security breach, action was promptly taken to prevent any other systems from being accessed and an investigation was launched to determine the contents of the encrypted files. That investigation revealed that the encrypted files contained the names of patients, along with their home addresses, medical billing information, dates of birth, and Social Security numbers. Electronic health records were stored in a different system and were not exposed.

It is not clear when the files were encrypted, although the security breach was discovered on July 11, 2016. Determining which patients had been affected and confirming contact details took some time, hence the delay in issuing breach notification letters to patients.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

While ePHI was potentially viewed, the investigation did not uncover any evidence to suggest that any ePHI had been obtained by any unauthorized individuals and no reports been received to suggest that data have been used inappropriately.

All patients affected by the incident have now been notified of incident by mail and have been offered identity theft protection services with Equifax for a period of 12 months.

University Gastroenterology has responded to the incident by enhancing security protections. Those measures include deactivating user accounts that are no longer in use, installing anti-malware software on all end points and servers, and removing the affected servers from the network.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.