Providence Medical Institute

Providence Medical Institute experienced a ransomware attack in April 2018 which led to the encryption of ePHI across its systems, affecting 85,000 individuals. The attack exposed significant vulnerabilities, including lack of a business associate agreement and inadequate access controls. As a result, the U.S. Department of Health and Human Services imposed a civil penalty of $240,000 due to the HIPAA Security Rule violations following the series of ransomware attacks. These incidents underline critical lapses in cybersecurity measures necessary to protect sensitive health information.

Source: https://www.hcinnovationgroup.com/cybersecurity/hipaa/news/55235235/240000-penalty-against-ca-based-providence-medical-institute

TPRM report: https://scoringcyber.rankiteo.com/company/providence-hospital_2

"id": "pro000032425",
"linkid": "providence-hospital_2",
"type": "Ransomware",
"date": "10/2024",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '85,000',
                        'industry': 'Healthcare',
                        'name': 'Providence Medical Institute',
                        'type': 'Healthcare'}],
 'data_breach': {'number_of_records_exposed': '85,000',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'ePHI'},
 'date_detected': 'April 2018',
 'description': 'Providence Medical Institute experienced a ransomware attack '
                'in April 2018 which led to the encryption of ePHI across its '
                'systems, affecting 85,000 individuals. The attack exposed '
                'significant vulnerabilities, including lack of a business '
                'associate agreement and inadequate access controls. As a '
                'result, the U.S. Department of Health and Human Services '
                'imposed a civil penalty of $240,000 due to the HIPAA Security '
                'Rule violations following the series of ransomware attacks. '
                'These incidents underline critical lapses in cybersecurity '
                'measures necessary to protect sensitive health information.',
 'impact': {'data_compromised': 'ePHI', 'financial_loss': '$240,000'},
 'ransomware': {'data_encryption': True},
 'regulatory_compliance': {'fines_imposed': '$240,000',
                           'regulations_violated': 'HIPAA Security Rule'},
 'title': 'Ransomware Attack on Providence Medical Institute',
 'type': 'Ransomware Attack',
 'vulnerability_exploited': ['Lack of a business associate agreement',
                             'Inadequate access controls']}