The Rise of Ransomware in Healthcare: How a Phishing Breach Led to a $240K HIPAA Fine
October 14, 2024 Unfortunately, the future of data breaches is ransomware, accounting for nearly two-thirds of data breaches. As ransomware remains a significant threat in the healthcare sector, another HIPAA fine has been issued concerning a ransomware incident. Recently, a healthcare organization was fined $240,000 following ransomware attacks, including phishing, that compromised the Protected Health Information of over 85,000 patients. What happened? The Center of Orthopaedic Specialists merged with Providence Medical Institute, a healthcare system in southern California. In February 2018, during the transition, an employee clicked on a malicious link from a phishing attempt, which encrypted over 85,000 files with ransomware. Subsequently, two more successful ransomware attacks were launched on the already vulnerable IT system. Between these attacks, PMI restored data using backup tapes. In the final ransomware attack, the malicious actors used stolen credentials from previous attempts to remotely access PMI’s systems. What could they have done? After the breach, several cybersecurity mistakes that affected almost 100,000 patients were brought to light. Before merging with PMI, the Center of Orthopaedic Specialists partnered with another IT company, Creative Solutions in Computers. However, PMI failed to sign a Business Associate Agreement with the IT company during the transition, a crucial HIPAA requirement. This agreement ensures that both parties understand and take the necessary precautions to protect PHI. Furthermore, PMI made numerous IT and cybersecurity mistakes, such as sharing logins, not properly separating private networks from public networks, failing to monitor access controls, and not encrypting ePHI, which allowed anyone with access to view it. The lack of proper IT infrastructure, which could have been easily avoided, significantly impacted numerous patients. What’s next? After the recent HIPAA fine, it’s crucial for your practice to take the necessary precautions and implement cybersecurity measures to safeguard your patients’ data. When establishing a culture of compliance for your practice, using smart software solutions can help you assess your practice’s status and offer efficient solutions to meet requirements, such as electronically managed Business Associate Agreements. To find out more about how intelligent software solutions can protect your practice from cyber attacks, schedule a consultation with a compliance consultant.
