Texas Hospital Diverting Ambulances in Wake of Assault

University Medical Center – a Lubbock, Texas-based public health system that includes a level-one trauma center and a children’s hospital – is diverting ambulances as it works to restore an IT outage affecting some patient services in the wake of a ransomware attack late last week.

See Also: Identity Security Trailblazers – Health First

UMC’s healthcare services together with its clinics and doctor places of work stay open, however sure departments and suppliers have been on downtime procedures because the incident was detected Thursday, in keeping with a UMC discover posted on its web site.

“Sufferers could encounter delays. Please deliver your medical prescriptions listing with you,” UMC mentioned. Non-emergency laboratory and radiology appointments are additionally being delayed. “Entry to clinics by way of telephones and the portal are usually not assured, so please come to the clinic for instant help,” the discover mentioned.

“Moreover, and out of an abundance of warning, we’re quickly diverting incoming emergency and non-emergency sufferers by way of ambulance to close by well being services till we restore entry to our methods,” UMC mentioned. “You probably have questions on an upcoming appointment, please name or examine along with your supplier.”

UMC mentioned it doesn’t have an estimated timeline for full restoration of companies. “We have now carried out downtime procedures and lodging wherever attainable as a way to decrease any disruption to our sufferers and our crucial companies. We proceed to fastidiously consider our operations with affected person security in thoughts. We’ll solely restore companies as soon as it’s deemed protected to take action.”

UMC can also be the first educating hospital for close by Texas Tech College Well being Sciences Middle, which can also be experiencing an IT outage.

It’s unclear whether or not the 2 incidents are associated. Neither UMC nor TTUHSC instantly responded to Data Safety Media Group’s requests for particulars about their outages.

TTUHSC in a Fb publish Monday said it was “working by means of an IT situation” and that till additional discover, crew members and college students will be unable to entry TTUHSC digital assets.

“On Sept. 30, there shall be restricted scientific operations and no tutorial operations at TTUHSC campuses and websites. Supervisors will keep in touch with crew members relating to who must report for work,” TTUHSC mentioned.

Beneath Scrutiny

UMC is among the many newest well being methods experiencing ransomware assaults in current weeks and months disrupting affected person care companies.

Missouri-based hospital chain Ascension and Michigan-based McLaren Health System suffered ransomware assaults in Might and August, respectively, leading to IT outages affecting scientific methods, corresponding to digital well being data, being offline for a number of weeks.

Regulators and lawmakers are intensifying their scrutiny of healthcare organizations that fall sufferer to such incidents, particularly following the February ransomware assault on Change Healthcare, which disrupted hundreds of healthcare sector entities for weeks.

Over the previous two years, the U.S. Division of Well being and Human Providers has been fining organizations for breaches brought on by ransomware assaults. DHS issued its fourth enforcement action thus far in opposition to HIPAA-regulated organizations following an investigation right into a ransomware incident.

HHS’ Workplace for Civil Rights levied a $250,000 monetary penalty and corrective motion plan in opposition to Washington state-based Cascade Eye and Pores and skin Facilities within the wake of a ransomware breach that affected 291,000 information containing electronic-protected well being data.

HHS OCR’s investigation into the incident discovered that Cascade Eye and Pores and skin Facilities did not conduct a HIPAA safety threat evaluation. This evaluation would have recognized potential dangers and vulnerabilities to ePHI in its methods. The middle additionally lacked ample monitoring of its well being data methods’ exercise to guard in opposition to a cyberattack.

Cascade Eye and Pores and skin Facilities agreed to pay the monetary penalty and implement a collection of measures to enhance its safety and privateness practices round PHI beneath the settlement with HHS OCR. This consists of growing insurance policies and procedures for responding to an emergency or different prevalence that damages methods that include ePHI.

“Cybercriminals proceed to focus on the heathcare sector with ransomware assaults,” mentioned Melanie Fontes Rainer, director of OCR on the U.S. DHHS, in a press release. “Healthcare entities that don’t completely assess the dangers to electronic-protected well being data and commonly assessment the exercise inside their digital well being file system go away themselves susceptible to assault and expose their sufferers to pointless dangers of hurt,” she mentioned.

“Making certain the confidentiality of electronic-protected well being data is crucial to guard well being data privateness and integral to our nationwide safety within the healthcare sector.”

In the meantime, final week two Democrat lawmakers – Senate Finance Committee Chair Ron Wyden, D-Ore., and Sen. Mark Warner, D-Va. – unveiled laws proposing stricter safety mandates for healthcare sector entities, particularly these which can be thought of crucial to nationwide safety (see: Healthcare Cyber Bill Calls for Corporate Accountability).

The Health Infrastructure Security and Accountability Act is the newest invoice aiming to assist stop healthcare sector organizations from falling sufferer to extremely disruptive cybersecurity assaults and associated main information breaches.