Providence Medical Institute experienced a ransomware attack in April 2018 which led to the encryption of ePHI across its systems, affecting 85,000 individuals. The attack exposed significant vulnerabilities, including lack of a business associate agreement and inadequate access controls. As a result, the U.S. Department of Health and Human Services imposed a civil penalty of $240,000 due to the HIPAA Security Rule violations following the series of ransomware attacks. These incidents underline critical lapses in cybersecurity measures necessary to protect sensitive health information.
"id": "pro000032425",
"linkid": "providence-hospital_2",
"type": "Ransomware",
"date": "10/2024",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"