PHI of Up to 3,634 Persons Compromised at Vista Radiology Ransomware Attack
Vista Radiology based in Knoxville, TN has advised 3,634 patients concerning a ransomware attack suffered on July 11, 2021 which caused the shutdown of its network. A prominent computer forensics agency carried out an extensive investigation of the attack. At the onset of the investigation, it seemed to indicate the main goal of the ransomware attack was to encrypt its files, and that there wasn’t any exfiltration of information involved. Nonetheless, Vista Radiology was advised on July 15 that certain information was discovered that files or folders including patient information were accessed and looked at.
The investigation established that the attacker encrypted the data files and a part of the files was accessed before encryption. The files that were viewed just comprised a number of patient data and no considerable amount of information was exfiltrated by the hackers. It cannot be determined whether the protected health information (PHI) of any specified patients were viewed, therefore notification letters were delivered to all patients possibly affected by the ransomware attack. The investigation revealed that PHI had not been obtained or abused.
Vista Radiology stated the encrypted records had backup copies and may be recovered and that it didn’t make a deal with the malicious third party. Measures have since been undertaken to strengthen the security of its system environment, which required a comprehensive rebuild and overhaul of network security. All impacted individuals were sent notifications and provided one year of free identity and credit monitoring services at no cost.
Mankato Clinic Privacy Breach Impacts 535 Individuals
Mankato Clinic based in Mankato, MN has identified a compromise of the PHI of 535 patients. On August 3, 2021, an employee emailed a spreadsheet that contains patient information by an employee to an external email account by mistake. The error was discovered within a couple of minutes. The email recipient was contacted and informed to get rid of the email and spreadsheet properly.
The recipient affirmed that the email message was gone and the spreadsheet was not opened; nonetheless, the email wasn’t encrypted therefore there is a slight possibility that it can be intercepted during transmission. The spreadsheet included these types of patient data: Name, address, email address, telephone number, birth date, sex, healthcare company’s name, diagnosis data, medical record number, and primary insurance provider.
The investigation affirmed the error happened because of the usage of the email auto-complete function. All workers were given HIPAA training, hence the staff involved knew the occurrence was a HIPAA breach and self-reported the problem.
