2017 is still several months away from ending and it is already shaping up to be one of the most volatile years on record for PHI data breaches. So far, 178 incidents are under investigation by the U.S. Department of Health and Human Services, impacting well over 3 million individual patient records. Below is a list of the top 10 HIPAA data breaches as of August 2017.
First on our list is a breach that took place in May of this year. The Memphis-based doctor’s office fell victim to a cyber attack that left thousands of patient records encrypted and inaccessible through typical ransomware methods. Administrators did not give into demands and alerted HHS of the attack.
The Atlanta-based health system was one of the early victims of ransomware this year. Hackers deleted patient data from Emory’s servers and demanded a ransom be paid before the data would be restored. This is atypical for most ransomware attacks, as the data is typically not deleted from servers, merely locked.
This attack actually occurred in December of 2016 but was not discovered, and therefore not reported until late January of the new year. This phishing attack compromised an email account that had access to thousands of patient records.
Next on our list is a cyber attack on PHI at VisionQuest Eyecare in Indianapolis. The April attack exposed thousands of pieces of information including medical claim data, patient contact info, and medical history.
This data breach at the Pennsylvania practice occurred in March and seems to be the result of unauthorized access by an individual. While there is no evidence of a cyber attack having been perpetrated, sensitive, identifying information of thousands of patients was exposed.
The Atlanta-based clinic fell victim to a ransomware attack in July, though further digging discovered unauthorized access as early as February 2016. Data backups allowed for systems to be restored quickly.
This ransomware attack took place earlier in the year, compromising servers and restricting access to nearly 300,000 patient records. As with every organization, Urology Austin notified the impacted patients via mail. The ransom was not paid and data was able to be restored from previous backups.
Soon after the completion of a merger that created the largest U.S.-based OB/Gyn practice, a ransomware attack against the organization’s network was detected. The ransomware notification indicated that access had been gained as early as January, though it did not present itself until several months later.
Personal data of half a million customers and employees of the Michigan-based home medical equipment supplier was compromised by a ransomware attack in mid April. While there was no indication that any of the data was a acquired or abused, the attacker was still able to disable the company's network.
Easily the largest data breach of 2017 (so far), this incident stands apart from the rest on our list. In March, Commonwealth reported that a former employee had placed sensitive information of nearly 700,000 individuals on an encrypted device with the intention of using that data for a personal project. While there is question of whether or not theft of a data on an encrypted device is truly a HIPAA violation, the number of records accessed is still staggering.Whether through ransomware, phishing, or theft, the threat of data breaches is real. When an organization falls victim, the trust of your patients is eroded and can be very difficult to repair. It is up to administrators to get at the front of such issues as quickly as possible in order to analyze the extent of the damage and notify patients immediately.
Your users are the weakest link in your security posture. Simulating the conditions of a real security breach is the most effective way to train your staff. If you are already have a mechanism in place, continue to simulate security breaches periodically. Here are the simple steps.
Perform the above steps every year and you will be glad that you did. Most security breaches happen through Phishing attacks. And the weakest link is the unsuspecting users.As we have shared in other blog posts, it really is a matter of when, not if a breach will occur. Do you have an adequate response plan in place? QliqSOFT can help. Our team of cyber security experts are available to discuss your concerns, vulnerabilities, and actionable solutions. Contact us today.
A lifelong communicator, this Tennessee native got his start in broadcast news before branching out into public media, corporate, communications, digital advertising, and integrated marketing. Prior to joining QliqSOFT as the company's first marketing team member, Ben shared his talents with organizations that include the University of Alabama, iHeartMedia, and The Kroger Company.
© 2024 QliqSOFT, Inc. All Rights reserved
