The protected health information (PHI) of an Eskenazi Health patient was compromised in a ransomware attack on August 2021. The patient is currently taking legal action against the healthcare organization over the data breach.
It is now typical for ransomware gangs to copy sensitive information prior to deploying ransomware for encrypting files. The stolen records are employed to pressure victims to make ransom payments, as was the situation in the cyberattack at Eskenazi Health. Eskenazi Health located in Indianapolis, IN uncovered the attack at the beginning of August and promptly turned off its computer programs so as to stop continuing unauthorized access and limit the attack. The healthcare service provider decided to redirect ambulances and postpone selected consultations as a precautionary measure as its electronic medical record system was not accessible.
As per the data breach investigation, Eskenazi Health’s systems were first compromised in May and the threat actors exfiltrated files that contain sensitive patient data. The issuance of notification letters to affected patients began at the beginning of November. Patients were advised with regards to the data breach and were given free identity theft protection and credit monitoring services. When sending notifications, there were no reports involving the misuse of patient information, even though some patient data were released on the gang’s data leak website. The breach report sent to the HHS’ Office for Civil Rights at the start of October reveals the breach impacted 1,515,918 patients.
Eskenazi Health stated the stolen information involved workers, providers, patients, previous patients, and providers and impacted names, addresses, phone numbers, email addresses, dates of birth, patient account numbers, health record numbers, diagnoses, clinical data, physicians’ names, insurance details, medications, passport numbers, driver’s license numbers, face images, credit card data, and Social Security numbers.
Terri Ruehl Young, the Eskenazi Health patient, was among the persons affected by the information breach. According to the lawsuit, Young alleges a bogus charge amounting to $370 was placed on the credit card she utilized for settling her bill and her Equifax credit report revealed there was an effort to alter her name.
The lawsuit claims patients put their trust in Eskenazi Health to safeguard its systems and patient data, nevertheless, the healthcare company betrayed that trust by not being able to use advanced security practices and proper safety measures to secure patient information. The lawsuit states unjust enrichment, negligence, and breach of contract.
The lawsuit likewise brings up the amount of time it had taken Eskenazi Health to alert patients regarding the security breach. The lawsuit says that breach notification letters were provided over 6 months right after the first security breach, and 3 months after the finding out of the breach by Exkenaki Health. The HIPAA Breach Notification Rule necessitates the sending of notifications in 60 days after the discovery of a data breach.
Cohen and Malad and John Steinkamp & Associates submitted the lawsuit wanting class-action status and a trial by jury. A Eskenazi Health representative mentioned the lawsuit is not yet officially served.
