Nearly two months after hackers waged an aggressive attack on the Baton Rouge Clinic, shutting down systems for weeks, cybersecurity experts have determined that 85 patients could have had some of their information compromised.
Clinic Executive Director Ed Silvey says the cybercriminals did not hack into the clinic’s electronic medical records system, mychart.org, which is where most patient information is stored. Still, he says, the clinic has notified the potentially affected patients, who represent a tiny fraction of the clinic’s overall patient base, that they could be at risk.
“We don’t know if any of those 85 had their information compromised,” he says. “But, if we were sending a claim to an insurance company, for example, we would have downloaded that from the patient’s EMR. That is the kind of information the hackers could have gotten.”
Those patients have been contacted and instructed how to protect themselves if they have come under attack, Silvey says.
Additionally, the other 308,000 or so patients in the clinic’s database have been contacted in a separate email and brought up to speed on the attack and the investigation. They are not believed to be at risk, Silvey says, but are being reminded to be on the lookout for suspicious email attachments or phishing scams.
“We just want to remind them to do all the things you should do to protect yourself and what to do if you think you have been compromised,” he says.
The email blasts come nearly two months after foreign hackers virtually shut down the clinic’s systems. As of today, all are back up and running except the external email system.
The FBI is continuing to investigate the case and is working with a national cybersecurity firm the clinic retained shortly after the attack to identify potential victims and develop new systems to mitigate and prevent future attacks.
Silvey confirms the hackers are from overseas but declines to identify their country of origin, on the advice of investigators. He also declines to say whether the clinic paid a ransom to the hackers.
“We followed the recommendations our cybersecurity firm made to us in consultation with the FBI,” he says, declining to say what that recommendation was.
As chilling as the attack was, Silvey says the clinic has learned valuable lessons from the experience.
“We learned a lot and will be a much better organization for it,” he says.
Our Lady of the Lake Regional Medical Center Foundation recently announced it, too, was the victim of a cyberattack. Silvey says he does not think the two attacks are related or were committed by the same hacker.
[polldaddy poll=10602452]
