Health Data Hacking Incident Affects 400,000 - HealthcareInfoSecurity

A surgery practice in Washington state has reported a hacking incident that resulted in a breach affecting 400,000 individuals, the largest added to the federal health data breach tally so far in 2019.

Columbia Surgical Specialists of Spokane reported the breach to the Department of Health and Human Services’ Office for Civil Rights, which now lists it on its HIPAA Breach Reporting Tool website of major health data breaches affecting 500 or more individuals.

The incident is described on the tally as involving a network server. No notification about the incident appeared on the practice’s website as of midday Tuesday.

A Columbia Surgical Specialists information systems manager tells Information Security Media Group that the hacking incident involved a ransomware attack on Jan. 7. The practice worked with a security firm to unlock its systems and recover its data without paying a ransom within a few days of the attack. Some of the impacted patient files are more than 20 years old, and the practice is still assessing how to notify various individuals, the manager says.