Three security incidents reported by healthcare organizations

Three recent breaches of protected health information demonstrate the continued proliferation and range of such incidents.

Hollywood Presbyterian Medical Center continues to grapple with a cyber attack that was discovered on February 12 and shut down its information network, including email. The local Fox News television affiliate reports that the attack includes a ransom demand of about 9,000 bitcoins, or $3.6 million, for restoration of the systems. In a phone interview with the station, the hospital's CEO Allen Stefanek described it as a random attack and not malicious. The hospital, which Fox reports is relying on fax machines and telephones to get work done, did not respond to repeated requests for additional information on the incident.

Also See: Thefts of patient medical records starting to add up

Alliance Health in South Jordan, Utah, which ships diabetes supplies to patients’ homes, is notifying about 40,000 customers that a test database holding protected health information was inadvertently left accessible to the Internet. Compromised data includes patient names, addresses, telephone numbers, emails, medications and limited clinical information. Social Security numbers and financial information were not affected, so protective services are not being offered. The organization has conducted an audit of all databases to prevent a recurrence.

A vendor in December notified Blue Shield of California that data was accessed by an unauthorized user after obtaining login credentials from customer service representatives. The incident affected information of about 21,000 individuals. Information at risk includes patient names, addresses, dates of birth and Social Security numbers. Blue Shield of California is offering one year of protective services from Experian that include credit monitoring, identity theft resolution and identity theft insurance.