Breach investigation uncovers separate breach impacting more than 170,000 patients
An Atlanta neurology clinic’s investigation of a ransomware attack on its network uncovered a separate cybersecurity incident going back more than a year. More than 170,000 individuals are affected, according to the Office for Civil Rights’ (OCR) breach tool.
Peachtree Neurological Clinic, P.C., (PNC) announced the breaches in a statement released July 11. PNC’s electronic medical record (EMR) system was hit by ransomware. PNC did not pay the ransom but was able to restore its files and impacted systems through backups. A subsequent investigation found no traces of ransomware on the restored system and did not find any indication that the ransomware exfiltrated PNC’s data, according to the clinic’s statement.
However, the investigation did discover a separate security incident that began in early 2016. PNC’s system was accessed by unauthorized individuals from February 2016 to May 2017. PNC does not believe the individuals are affiliated with PNC. The clinic was not able to determine precisely what data was accessed, but believes it’s possible they were able to access the EMR. According to OCR’s Wall of Shame, 176,295 individuals are affected. The clinic’s EMR stores patients’ protected health information (PHI) including:
- Addresses
- Dates of birth
- Driver’s license numbers
- Health insurance information
- Names
- Prescription information
- Social Security numbers
- Telephone numbers
- Treatment or procedure information
PNC reported the incident to law enforcement and OCR. The incident is currently under investigation. The clinic implemented additional security measures to help prevent unauthorized access.
Affected individuals are being offered 12 months of free credit monitoring through ID Experts®. PNC encourages affected individuals to register at www.myidcare.com/enrollpeachtree; registration must be completed before October 7. PNC also set up a dedicated toll-free hotline at 866-690-0768.