CommonSpirit Health has provided an update on its October 2022 ransomware attack and has confirmed that the threat actors behind the attack accessed files containing patient information.
The attack was detected by CommonSpirit Health on October 2, 2022, and action was immediately taken to secure its network. While the attack caused disruption at its healthcare facilities due to systems being taken offline to contain the incident, CommonSpirit Health said there was no impact on clinic, patient care, and associated systems at Dignity Health, Virginia Mason Medical Center, TriHealth, or Centura Health facilities. The forensic investigation confirmed that the attackers had access to its network between September 16, 2022, and October 3, 2022.
CommonSpirit Health has now confirmed that the attackers gained access to parts of its network containing files that included the protected health information of patients of Franciscan Medical Group and Franciscan Health in Washington state, including patients that had received medical services at St. Michael Medical Center (formerly Harrison Hospital), St. Anne Hospital (formerly Highline Hospital), St. Anthony Hospital, St. Clare Hospital, St. Elizabeth Hospital, St. Francis Hospital, and St. Joseph Hospital. Those facilities are now known collectively as Virginia Mason Franciscan Health, which is an affiliated entity of CommonSpirit Health.
ComnmonSpirit Health has confirmed that the affected files contained the information of patients and their family members and caregivers, including names, addresses, phone numbers, birth dates, and unique internal patient identifiers. At this stage, no evidence has been found of attempted or actual misuse of the data stored on its systems.
CommonSpirit Health said the majority of EHRs across the CommonSpirit Health system are now back online and patient portals can now be accessed. The review of affected files is ongoing and it has yet to be confirmed how many individuals have been affected. CommonSpirit Health has recommended patients check their account statements for accuracy and should report any services or charges that were not incurred to their provider or insurance carrier.
The post CommonSpirit Health Says Patient Information Accessed in October 2022 Cyberattack appeared first on HIPAA Journal.