Yikes! Want to know what a ransomware attack sounds like in healthcare?
According to a CBC report published yesterday, a home medical services company was recently hacked and tens of thousands of health records for home care patients across Ontario were held for ransom.
The home care company issued a public statement in June 2018 confirming that it had been the victim of a cyber attack.
A group claiming responsibility has shared with the CBC copies of health records they collected through this cyber attack. The CBC report says the sample they have seen includes “thousands of patient medical records with phone numbers and addresses, dates of birth, and health card numbers, as well as detailed medical histories including past conditions, diagnoses, surgical procedures, care plans and medications for patients across the province.”
To put it mildly … that’s not good.
We have heard about cyber attacks before in the health sector. You may remember the stories of the WannaCry virus that attacked healthcare organizations around the world in May 2017. The UK was especially hit hard – where they had to cancel surgeries and other medical appointments. What you might not realize is that Ontario was also hit in that ransomware attack. An Ontario hospital was hit by the virus – which negatively affected their computer systems for weeks although they were able to ultimately keep the hackers out of their health records.
What does this new story of an Ontario ransomware attack mean for your health team?
It means a few things:
- Make sure you speak with your security team or consultants to ensure your health records are encrypted and protected against hacking.
- Train your team about how to identify a malicious email and not open it! More practical tips in my previous blog on the topic.
- Read the prevention tips against ransomware issued by the Information and Privacy Commissioner of Ontario and implement those activities for your team.
Good security practices and protocols require everyone’s attention. Your security is only as good as your team members allow it to be.
This is a cautionary tale worth the attention of every Privacy Officer in health care. <Shiver>
