Children’s Choice Pediatrics
PediHealth, PLLC, d/b/a Children’s Choice Pediatrics (“Children’s Choice”), in December 2019, notified patients of a data security incident that may have involved the personal and protected health information of 12,689 patients.
McKinney, Texas-based Children’s Choice discovered in October 2019 that it was the victim of a ransomware attack that encrypted the data stored in its network. Children’s Choice took action to secure the network and retained cybersecurity experts to assist with an investigation. Children’s Choice attempted to restore the infected data. However, some patient records were irretrievably deleted.
To prevent similar events from occurring in the future, Children’s Choice is strengthening security measures and ensuring its networks and systems are secure.
Children’s Choice sent notification letters to the potentially impacted patients to notify them about this incident and to provide resources to assist them including steps to monitor and protect personal information.
Central Kansas Orthopedic Group
Central Kansas Orthopedic Group (CKOG), based in Great Bend, Kansas, discovered that an unauthorized party or group gained access to its computer system in November 2019. CKOG learned of this intrusion when the attacker deployed ransomware.
CKOG did not pay the demanded ransom and was able to restore its system from available backups. All medical records were restored. However, it is possible an unauthorized person or persons had access to medical records of 17,214 patients. The information in the patient records included: address, birthdate, driver’s license number (or other form of state-issued identification), health information related to treatment at CKOG or referring providers, health insurance number, social security number, and email address.
Since contacting a third-party forensic company, CKOG is working to enhance its overall security platform and security protocols.
What Can Be Done?
The National Cybersecurity Center of Excellence (NCCoE) has announced its intent to “establish tools and procedures to defend, detect, and respond to data confidentiality events.” To facilitate this effort, it released drafts of National Institute of Standards and Technology (NIST) Cybersecurity Special Publications. The publications are practice guides meant to benefit executives, chief information security officers, system administrators, or those who have a stake in protecting their organizations’ data, privacy, and overall operational security.
The guides are “Detecting and Responding to Ransomware and Other Destructive Events” and “Identifying and Protecting Assets Against Ransomware and Other Destructive Events.” The comment period on the guidelines closes March 20, 2020.
