Since October, five ASCs have reported patient data stolen, compromised or breached through cyber attacks, stolen laptops and staff misdeeds.
Columbus (Neb.) Surgery Center and Eye Physicians fell victim to a ransomware attack; the center reported a data security incident related to a ramsomware attack Oct. 7, 2017, although, there wasn't any evidence of unauthorized patient information access. The ASC hired outside security consultants to conduct a network security assessment and made changes as a result.
On Jan. 8, an unauthorized third party gained access to around 135,000 patient records at Albany, N.Y.-based St. Peter's Surgery & Endoscopy Center. There hasn't been evidence that patient information was accessed, but malware potentially compromised a server containing personal patient information. The ASC notified affected patients Feb. 28 and is offering free credit monitoring for a year for Medicare patients.
Carolina Digestive Health Associates in Charlotte, N.C., reported that a former employee had stolen 100 patients' personal data, including Social Security numbers and birthdays, and given the information to fraud suspects. The center is notifying patients by mail and offering free identity protection.
Silver Spring, Md.-based Capital Digestive Care notified the CDC of a data breach Feb. 23. A third-party vendor for the center that stored files on a commercial cloud server reportedly had inadequate security and exposed patient data to risk. The breach did not include Social Security numbers or financial information.
On Feb. 26, Baton Rouge, La.-based Eye Care Surgery Center found a laptop that potentially stored patient information was stolen. Since then, the ASC has installed a multi-camera security system and conducted an investigation on the information contained in the stolen laptop. The ASC notified 2,553 patients their information may have been stolen and submitted the breach to HHS April 27.