Texas Hospital Discloses Huge Breach - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Healthcare // Security & Privacy
News
2/5/2014
02:00 PM
Connect Directly
LinkedIn
Google+
Twitter
RSS
E-Mail
50%
50%

Texas Hospital Discloses Huge Breach

St. Joseph Health System reports that as many as 405,000 records may have been compromised, but actual damage remains speculative.

Hackers Outsmart Pacemakers, Fitbits: Worried Yet?
Hackers Outsmart Pacemakers, Fitbits: Worried Yet?
(Click image for larger view.)

St. Joseph Health System has confirmed a security breach affecting the records of up to 405,000 past and current patients, as well as employees and employees' beneficiaries.

St. Joseph says it believed the attack occurred between Dec. 16 and 18, when one of its computer servers was hacked, and that the exposure ended on the 18th when the attack was discovered and the server was shut down. The health system hired national security and computer forensic experts to investigate. The ongoing investigation suggests the attackers may have gained access to records including names, Social Security numbers, dates of birth, and possibly addresses, as well as the medical information of patients and bank account data for employees.

If substantiated, this would be one of the largest healthcare data breaches ever reported, and the largest by an individual health system. The largest, according to US Department of Health and Human Services data, involved 780,000 records in a 2012 incident at the Utah Department of Health and 475,000 records in a 2008 report from the Puerto Rico Department of Health. Since both of these are government agencies, the St. Joseph breach could potentially have the biggest loss of patient data reported by an individual hospital.

[Don't let it happen to you. Read HIPAA, SOX & PCI: The Coming Compliance Crisis In IT Security.]

So far, the damage done is a matter of speculation.

"While it is possible that some information was accessed or taken, the forensics investigation has been unable to confirm this," wrote Denise Goffney, corporate compliance officer and privacy officer, in a message posted on the hospital website:

It is important to note that SJHS has received no reports that any of the personal information involved has been misused. We take this matter, and the security of our patients', employees', and employee beneficiaries' personal information, very seriously. As a precaution, SJHS wants to assist individuals affected by this incident in protecting their identity, even though we are not aware of any misuse of the information, and we have been unable to determine whether any data was in fact taken.

As is common in these incidents, St. Joseph is offering affected individuals free credit and identity protection services.

Medical data breaches seem to show up on the 6 o'clock news almost every week. If you think it wouldn't happen to you -- or the financial impact will be minor -- think again. Download the Healthcare Data Breaches Cost More Than You Think report today. (Free registration required.)

David F. Carr oversees InformationWeek's coverage of government and healthcare IT. He previously led coverage of social business and education technologies and continues to contribute in those areas. He is the editor of Social Collaboration for Dummies (Wiley, Oct. 2013) and ... View Full Bio

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
David F. Carr
50%
50%
David F. Carr,
User Rank: Author
2/5/2014 | 2:43:18 PM
Standard bureaucratic language?
Is that just standard bureaucratic language to say our system was breached and the hackers had full access to all this data ... but we're just not sure they actually took any of it.

Is there some example of where hackers gained that kind of access and didn't take advantage of it? Like the Grinch seeing the light and putting all the presents back neatly in their place?
<<   <   Page 2 / 2
News
COVID-19: Using Data to Map Infections, Hospital Beds, and More
Jessica Davis, Senior Editor, Enterprise Apps,  3/25/2020
Commentary
Enterprise Guide to Robotic Process Automation
Cathleen Gagne, Managing Editor, InformationWeek,  3/23/2020
Slideshows
How Startup Innovation Can Help Enterprises Face COVID-19
Joao-Pierre S. Ruth, Senior Writer,  3/24/2020
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
IT Careers: Tech Drives Constant Change
Advances in information technology and management concepts mean that IT professionals must update their skill sets, even their career goals on an almost yearly basis. In this IT Trend Report, experts share advice on how IT pros can keep up with this every-changing job market. Read it today!
Slideshows
Flash Poll