Sometimes you think your PHI have escaped a ransomware attack…. but they may not have as this notification from Northwest Rheumatology reminds us.
On April 10, 2017, Northwest Rheumatology (“NW Rheumatology”) experienced a ransomware incident which left a limited portion of its computer system encrypted and inaccessible. NW Rheumatology immediately contacted its computer security vendor who investigated the matter and informed NW Rheumatology that no protected health information was accessed or acquired during the incident. Based on this report, NW Rheumatology believed that the attack on its systems was limited and that patient information was not affected.
However, on June 18, 2017, NW Rheumatology discovered additional evidence of unauthorized access to its systems from the ransomware attack. NW Rheumatology immediately hired an independent computer forensic firm to conduct an in-depth investigation. On July 6, 2017, the forensic team confirmed that an unauthorized individual had gained access to NW Rheumatology systems but was unable to determine whether any protected health information had actually been accessed.
While NW Rheumatology has no evidence that patient information was accessed or removed from its system, out of an abundance of caution, NW Rheumatology has sent impacted patients a letter informing them of this incident and providing free credit monitoring and identity restoration services. NW Rheumatology urges its patients to take advantage of these services.
NW Rheumatology has taken steps to enhance the security of its systems, and continues to actively work with its computer security vendor to ensure that all information maintained by NW Rheumatology is kept secure. If you have any questions about this incident, please 1-800-342-9326, Monday through Friday, 6 a.m. to 6 p.m. Pacific Time.
Source: Northwest Rheumatology