The Baton Rouge Clinic in Louisiana experienced a cyberattack in early July that took its email and phone system out of action and limited its lab and radiology services. The cyberattack, which involved ransomware, took certain systems out of action for several weeks. It is now two months after the attack and the external email system is still not working.
The clinic’s medical record system was not breached, so the data potentially viewed and/or obtained were limited. The attack was performed by an overseas adversary, according to a statement issued by the clinic. It is unclear whether the ransom was paid. The clinic said, “We followed the recommendations our cybersecurity firm made to us in consultation with the FBI.”
The investigation into the breach confirmed that the attackers potentially accessed the protected health information of 85 patients, all of whom have now been notified. The types of information involved were EMR data downloaded in order to send claims to insurance companies.
Separate breach notification letters were also sent to 308,000 patients. Those individuals are not believed to be at risk but have been advised to be vigilant and to look out for suspicious emails.
NorthShore University Health System, UK HealthCare, & Main Line Health Victims of Blackbaud Ransomware Attack
NorthShore University Health System, University of Kentucky (UK) HealthCare, and Main Line Health have recently announced that they have been affected by the ransomware attack on their business associate, Blackbaud.
The attacker gained access to Blackbaud’s systems between February 7 and May 20, 2020 and backups of databases were stolen by the attackers prior to the deployment of ransomware. Blackbaud paid the ransom and obtained the keys to decrypt files and received assurances that all information stolen in the attack has been securely and permanently deleted.
NorthShore University Health System, based in Evanston, IL, confirmed the data of 348,000 patients were compromised in the attack. The compromised data were limited to names, dates of birth, and limited clinical information. The risk to affected individuals is believed to be low.
UK HealthCare said the data of approximately 163,000 donors who had previously been patients were compromised in the attack. The breached information was limited to names, addresses, dates of birth, medical record numbers, admission dates, area of service and attending doctors.
The attack also involved the donor database of Main Line Health. The database contained patient donors’ or prospective donors’ names, ages, genders, dates of birth, medical record numbers, date(s) of treatment, department(s) of service and treating physicians. 60,595 individuals are known to have been affected.
The post Up to 308,000 Patients Potentially Affected by Baton Rouge Clinic Ransomware Attack appeared first on HIPAA Journal.