Urology Austin Ransomware Attack Announced
Urology Austin has started notifying 279,663 patients that some of their protected health information may have been impacted in a recent ransomware attack. Potentially, the attackers gained access to names, addresses, dates of birth, medical information and the Social Security numbers of patients.
The attack occurred on January 22, 2017, although rapid detection of the incident limited the damage caused. Within minutes of the attack, the computer network was shut down to prevent the spread of the infection and potential access/exfiltration of PHI. However, even with the fast response, data stored on the organization’s servers were encrypted.
Ransomware often blindly encrypts data. The attacks are intended to cause major disruption to patient services to force an organization into paying a ransom demand to obtain a key to unlock the encryption. Data are not accessed or stolen by the attackers.
The risk of patients’ protected health information being accessed and misused after this type of attack is often low. In this case, the decision was taken to provide identity theft monitoring services to patients out of an abundance of caution ‘to help relieve concerns and restore confidence.” A commendable action by the Urology center to ensure patients are protected, in the event that data was accessed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Urology Austin has also taken a number of steps to prevent similar incidents from occurring in the future. System backups have been updated to ensure fast recovery in the event of a further attack and network security has been improved.
The breach notice submitted to the California attorney general’s office provides an indication of how the ransomware attack occurred. Urology Austin said employees have been retrained regarding suspicious emails, patient privacy and security, suggesting the infection was the result of a member of staff responding to a malicious email – one of the most common methods attackers use to install ransomware.
