Hospital Cyberattacks Spark Disruptions, Litigation, and HIPAA Settlements
Ransomware attacks on university health systems in New Mexico and Ohio caused patient care disruptions and data theft concerns, while a separate HIPAA settlement highlights regulatory scrutiny.
Two major U.S. university health systems, the University of New Mexico Health Sciences Center and University Hospitals in Ohio, are currently grappling with the aftermath of significant cyberattacks. These incidents have led to disruptions in patient care, including the temporary diversion of ambulances, suspension of outpatient surgeries, and rescheduling of appointments. The attacks also raise concerns about potential theft of sensitive patient information, alleged extortion demands, and the specter of class-action litigation.
The University of New Mexico Health Sciences Center experienced an attack that forced its Level-1 trauma center to divert ambulances and suspend various services. While patient services and classes have since resumed, the university is facing allegations from the threat actor Byod, which claimed to have compromised a substantial number of devices and accessed sensitive student, employee, and patient data. UNM has not publicly confirmed the nature of the attack or data theft but has warned individuals about potential scams and phishing attempts.
In Ohio, the 21-hospital University Hospitals system is still working to restore IT systems following a cyberattack that took its MyChart patient portal offline and disrupted other essential services. The health system is collaborating with cybersecurity experts and law enforcement, but has not provided a timeline for full system restoration. Patients and staff have expressed frustration over the ongoing disruptions.
Both health systems have issued warnings to patients and employees about potential scams, advising them not to click on suspicious links or provide personal information, as threat actors may try to exploit the situation. At least one law firm has announced an investigation into the UNM incident for potential class-action litigation, and a federal class-action lawsuit has already been proposed against University Hospitals.
These recent incidents occur as federal regulators have imposed a significant penalty on another healthcare provider. The U.S. Department of Health and Human Services' Office for Civil Rights announced an $800,000 settlement with Lehigh Valley Health Network. This settlement stems from potential HIPAA violations discovered during an investigation into a 2023 ransomware attack that exposed the sensitive data of over 248,000 individuals.
The settlement involved allegations that the Pennsylvania health system failed to adequately protect sensitive patient information, including photographs of cancer patients undergoing treatment, which were subsequently posted on the dark web. This case underscores the severe regulatory and financial consequences that healthcare organizations can face following data breaches and ransomware attacks.
The ongoing wave of cyberattacks targeting the healthcare sector highlights the critical need for robust cybersecurity measures. The disruptions caused by these attacks not only impact patient care and trust but also lead to significant financial liabilities through regulatory fines and legal settlements, emphasizing the high stakes involved in protecting sensitive medical data.