{"id":4455,"date":"2016-02-19T00:00:00","date_gmt":"2016-02-19T00:00:00","guid":{"rendered":"https:\/\/www.healthlawpolicymatters.com\/?p=4455"},"modified":"2021-11-03T00:01:31","modified_gmt":"2021-11-03T00:01:31","slug":"hollywood-presbyterian-concedes-to-hackers-demands-in-ransomware-attack","status":"publish","type":"post","link":"https:\/\/www.healthlawpolicymatters.com\/2016\/02\/19\/hollywood-presbyterian-concedes-to-hackers-demands-in-ransomware-attack\/","title":{"rendered":"Hollywood Presbyterian Concedes to Hacker\u2019s Demands in Ransomware Attack"},"content":{"rendered":"\n

In a chain of events that should be a wake-up call to any entity using and storing critical health information, Hollywood Presbyterian Medical Center (\u201cHPMC\u201d) has\u00a0announced<\/a>\u00a0that it paid hackers $17,000 to end a malware attack on the hospital\u2019s computer systems. On February 5, HPMC fell victim to an attack that locked access to the medical center\u2019s electronic medical record (\u201cEMR\u201d) system and blocked the electronic exchange of patient information. Earlier reports indicated that the hackers had originally demanded $3,400,000.<\/p>\n\n\n\n

Such \u201cransomware\u201d attacks are caused by computer viruses that wall off or encrypt data to prevent user access. Hackers hold the data ransom, demanding payment for the decryption key necessary to unlock the data. The attacks are often caused by email phishing scams. The scams may be random or target particular businesses or entities. In the case of HPMC, the medical center\u2019s president and CEO indicated to media outlets that the attack was random, though Brian Barrett, writing for\u00a0Wired<\/em>,\u00a0questioned that assertion<\/a>.<\/p>\n\n\n\n

The medical center\u2019s announcement of the resolution of the incident indicates that there is no evidence that patient or employee information was accessed by the hackers as part of the attack. Even if the data was not compromised, the attack led to enormous hassles at the hospital, returning it to a pre-electronic record-keeping system.<\/p>\n\n\n\n

On February 2, 2016, three days before the HPMC attack, the Department of Health & Human Services Office for Civil Rights (\u201cOCR\u201d) announced the launch of its new Cyber-Awareness Initiative. That announcement included information on ransomware attacks and prevention strategies. Suggested prevention strategies from OCR included:<\/p>\n\n\n\n

  1. Backing up data onto segmented networks or external devices and making sure backups are current.<\/li>
  2. Ensuring software patches and anti-virus are current and updated.<\/li>
  3. Installing pop-up blockers and ad-blocking software.<\/li>
  4. Implementing browser filters and smart email practices.<\/li><\/ol>\n\n\n\n

    Most of these prevention strategies are HIPAA security measures that ought to be in place generally. As OCR indicates, smart email practices and training the workforce on them are key elements to preventing phishing scams. Before clicking on a link in an email or opening an attachment, consider contextual clues in the email. The following types of messages should be considered suspicious:<\/p>\n\n\n\n