On October 11, 2020, Sonoma Valley Hospital based in California encountered a computer security breach that resulted in the shutdown of its computer systems, hence “a significant downtime event” occurred.
The hospital went ahead with its business continuity plan and continued to provide care to patients though its computer systems were offline. All through the incident, the hospital’s emergency department was available and performed elective and essential surgeries. Almost all diagnostic services were available with no interruption, though the event did bring about issues for a number of patients. The patient website was available during the incident, but new results were not published starting October 11.
Sonoma Valley hospital investigated the incident immediately with the assistance of third-party cybersecurity experts to fast track recovery efforts. To date, there are no details released regarding the precise reason for the incident. It is also not known if the incident was a ransomware attack or if there was a compromise of patient data.
Lycoming-Clinton Joinder Board Discovers Even More Data Breach
Lycoming-Clinton Joinder Board (LCJB) is running programs that offer services to people having mental conditions or intellectual handicaps in the region of Lycoming and Clinton Counties, Pennsylvania. It experienced a breach and is now informing 14,500 individuals regarding the possible compromise of some of their protected health information (PHI).
On August 10, 2020, while checking a previous data breach, LCJB found out that an unauthorized person viewed the email accounts of three personnel. An audit of the email accounts showed they comprised patient data, however, it wasn’t possible to know whether the unauthorized persons accessed or acquired any details in the email accounts.
Data in the accounts differed from one patient to another and might have involved names, birth dates, addresses, medical insurance numbers, medical record numbers, medical backgrounds (such as diagnoses, substance abuse, laboratory tests and findings, physical or mental health assessments, and treatment or provider data), care costs, or circumstances of abuse. The Social Security numbers of a number of persons were also exposed.
The investigation affirmed that the unauthorized individual intermittently accessed the three accounts from August 5, 2020 to August 10, 2020. A previous breach uncovered on June 23, 2020 was also determined to be an email security breach that affected two email accounts of employees. An unauthorized person accessed those accounts between June 19, 2020 and June 23, 2020 and exposed the information of 3,905 patients. Although both incidents had similarities, it wasn’t possible to say that the same individual was behind them.
As a response to the incidents, LCJB has implemented a number of steps to enhance email security, which includes maximizing password complexity, implementing 2-factor authentication with remote access, limiting systems access to people within the United States, and bettering its HIPAA training program for employees. Policies and procedures were also created and implemented that call for personal details to be completely deleted on a regular basis from the network and the email system.