Hospital Suffers Breach; Reminder To All To Protect Their Personal Information

There is yet another reminder that healthcare records are still valuable. A small rural Tennessee hospital recently became a victim of a data breach when cryptocurrency-mining software was found on its electronic health record (EHR) system. It may not seem like a big deal to some, because after all it’s just mining cryptocurrency. It’s not worming its way through the network. However, it truly does tell us that no size of a company or industry is immune from hackers and their data-breaching ways. In this case, roughly 24,000 patients were affected.

The hospital, Decatur County General in Parsons, TN is not certain that patient data was not exposed, even though the intent of the malware was to mine the coveted cryptocurrency. Investigations are ongoing. Typically, that type of software will use computing resources to a level that gets someone’s attention. This is likely how it was discovered.

What is concerning is how it got there in the first place. Very little is being disclosed so far, other than it happened on a server managed by a third-party. Once it was discovered, it took the vendor two months to notify the hospital that it occurred. Although they replaced the server within four days, the user information was being circulated by the hackers for two months before the victims were notified and could move to protect themselves. Information potentially accessed included patient names, social security numbers, addresses, birth dates, insurance information, and clinical data.

This points out how important it is to ensure your identity and personal information is protected at all times. 

• Create a unique password for every account
• Keep antivirus and anti-malware software updated on all devices
• Subscribe to an Identity Theft protection service
• Verify unexpected attachments and links with the sender before opening, even from known people

Patients affected are being notified and are being offered one year of credit-monitoring service. Any time a breach occurs and credit monitoring is offered, take advantage. This is of course if you haven’t already frozen your credit due to another breach, such as was recommended after the Equifax breach. This is because once you have frozen your credit, no one can access your reports and that is needed for a monitoring service to work correctly.

That said, if you need to keep your credit reports available, sign up for the service if you don’t already have one active. It’s possible that you can start this one when the other one ends. Check the fine print on the letter you get with this to see if there is an expiration date for signing up. These services will not protect you from fraud or identity theft. They will alert you when something suspicious happens and you can take action quicker. You will still need to closely monitor your credit reports to stay on top of them.

For companies using third-parties to manage systems, always be sure vet them thoroughly. Find out what security measures they have in place and what their risk mitigation plan is. If you don’t feel good about it, find a different vendor to handle your sensitive information. Remember that just because your organization may be small, the bad actors out there won't discriminate. It's every organization's responsibility to act against potential threats.