Ransomware attacks are cause for concern in the healthcare industry, the wealth of sensitive information, large budgets, and lack of proper safeguards, make the industry the perfect target for these types of attacks. Ransomware attacks use malicious software to gain access to a computer system, usually disabling the system, until an amount of money is paid.
The Southeastern Council on Alcoholism and Drug Dependence (SCADD) Victim of Ransomware Attack
On February 18, the Southeastern Council on Alcoholism and Drug Dependence (SCADD) noticed disruptions in its network; the SCADD immediately hired third-party forensic experts to investigate the scope and nature of the attack. It was determined that protected health information (PHI) of 25,148 patients may have been compromised. This includes Social Security numbers, names, addresses, and medical records.
SCADD is notifying patients and will be offering credit monitoring for free to affected individuals, “The confidentiality, privacy, and security of information is one of SCADD’s highest priorities and the organization takes this matter seriously.” Although SCADD took proper measures by notifying the Department of Health and Human Services (HHS) of the breach, it is unclear if they were in violation of HIPAA law. The Office for Civil Rights (OCR) is investigating the incident.
How to Prevent Ransomware Attacks
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released guidance advising organizations on how to protect themselves against these types of attacks. The former director of the OCR, Jocelyn Samuels, made the following recommendations:
- Conducting a risk analysis to identify threats and vulnerabilities to electronic protected health information (ePHI) and establishing a remediation plan to mitigate those identified risks
- Implementing procedures to safeguard against malicious software
- Training authorized users to detect malicious software and reporting such detections
- Limiting access to ePHI to only those persons or software programs requiring access
- Maintaining an overall contingency plan that includes disaster recovery, emergency operation, frequent data backups, and test restorations
- Understanding ransomware, how it works, and knowing how to spot the signs
- Implementing security incident responses and mitigating the consequences of ransomware
Making sure your organization has proper safeguards in place to protect PHI can save your organization from ransomware attacks. Ransomware attacks can be costly and negatively affect your organization’s reputation.
