[BreachExchange] 7, 000 Patients Notified About Pawnee County Memorial Hospital Malware Attack

[Destry Winant]

https://www.hipaajournal.com/7000-patients-notified-about-pawnee-county-memorial-hospital-malware-attack/

Pawnee County Memorial Hospital in Pawnee City, Nebraska, is alerting
7,038 patients that some of their protected health information has
potentially been accessed by a hacker.

On November 29, 2018, the hospital learned that malware had been
installed which allowed an unauthorized individual to gain access to
its email system.

Malware was injected into the hospital’s email system when an employee
opened a malicious email attachment. According to Pawnee County
Memorial Hospital’s substitute breach notice, the email appeared to
have been sent from a trusted source and the email attachment seemed
genuine.

Assisted by a third-party computer forensics expert, the hospital
determined that the email attachment had been opened on November 16,
2018. The hacker was able to access employees’ email accounts from
November 16 to November 24.

The compromised email accounts contained a range of business reports,
clinical reports, clinical summaries, and other internal documents.
Those documents contained patients’ full names along with one or more
of the following data elements: Date of birth, address, diagnosis, lab
test results, medical record number, insurance information, state ID
number, driver’s license number and, for a limited number of patients,
Social Security number.

While PHI access was possible, it is unclear whether the hacker viewed
or obtained any patient information. The hospital believes the attack
was financially motivated and was not conducted with the aim of
stealing patient information.

In response to the breach, the hospital reset all passwords on
employee email accounts and additional technology safeguards are being
implemented to improve email security.

The hospital has sent breach notification letters to all patients
whose PHI was exposed and has offered complimentary enrollment in the
MyTrueIdentity online credit monitoring service for 12 months.
b