MultiCare Health System in Washington state disclosed this week that a ransomware attack in December last year led to the release of personal information for more than 210,000 of its patients, healthcare providers, and staff. The attack targeted a third-party software vendor for health management company Woodcreek Provider Services, which supports several MultiCare health centers.
The attackers infiltrated MultiCare data through Netgain Technology, a software vendor for Woodcreek based in Minnesota. The original attack is thought to have occurred some time between November 24 and December 3 last year. The personal information exposed in this attack included not only names and addresses but medical records, social security numbers, and bank account numbers.
The attack constituted a major HIPAA breach, and Woodcreek reported the incident to the Washington attorney general. While the bulk of the breached data affected people in Washington, the attack on Netgain Technology also affected personnel in the county government of Ramsey County, Minnesota, which is home to the state capital St. Paul.
Effects of the Attack
Woodcreek Provider Services disclosed that it paid a ransom, and on January 18, 2021 it received a copy of the stolen data and proceeded to notify affected individuals. This breach potentially put thousands of people’s livelihoods at risk, and could have exposed their private medical details to the general public. This, of course, could have led to a costly class action suit or a string of litigation.
Patients, doctors, and staff are not the only victims in this case, however, as Woodcreek Provider Services, MultiCare Health System, and Netgain Technology are all involved to various degrees in this single incident. The breach was through Netgain Technology’s systems, which could affect its reputation as a software provider. The incident could also damage Woodcreek’s reputation as a service provider among healthcare systems. The association of Woodcreek with MultiCare could also rope the Washington-based organization into the incident and sully its reputation. The costs each party faces are not limited to the ransom and repair costs, but could also cause long-term damage in lost business.
Preventative Measures
Though this ransomware incident attacked the software, such breaches can easily happen directly to the healthcare provider. HIPAA is the federal law that standardizes patient privacy across the United States and includes strict guidelines that put the onus on providers to protect their patients’ information. While this puts pressure onto healthcare organizations, technology companies that provide services to them must offer HIPAA-compliant hardware and software.
SecureData offers the healthcare industry—from large, sprawling medical complexes to cozy private practices—a complete and comprehensive security solution that can help the medical industry meet HIPAA standards. Our SecureDrive line of products can be incorporated to provide more restrictive measures on drives and computers in order to prevent breaches from within the organization.
Healthcare organizations rely on computers and the easy transfer of information among them. This leads to vulnerable USB ports through which viruses can be uploaded or sensitive information taken. The SecureGuard solution helps to protect a breach from the organization’s computers by blacklisting mass storage devices unless an administrator specifically allows them, which they can customize through a convenient console. SecureGuard will lock a computer when an unauthorized device is inserted, or restrict authorized devices to operate only in Read Only mode.
SecureGuard uses the Remote Management console, which gives administrators control over which devices can and cannot be used on company computers. This convenient system allows administrators to manage computers from a central location, and only requires internet access to operate. As added security, Remote Management complements the SecureDrive BT and SecureUSB BT mass storage devices, which both require user authentication to unlock via a mobile app. Remote Management also allows administrators to set geo- and time-fencing on either BT drive, meaning these devices will not operate outside of a defined area or time.
SecureData provides a comprehensive solution to help you meet strict HIPAA standards.
.png){kind=small}
