Some patient data may be impacted after cyber security event

SAGINAW, Mich. (WNEM) – The major healthcare nonprofit Ascension said it has made progress in its investigation into the cyber security event that disrupted its clinical operations on May 8.

Related: Ascension healthcare system investigates cyber security event

Ascension said it has evidence indicating attackers took files from a small number of file servers used by its associates primarily for daily and routine tasks.

“These servers represent seven of the approximately 25,000 servers across our network,” an Ascension spokesperson said. “Though we are still investigating, we believe some of those files may contain Protected Health Information and Personally Identifiable Information for certain individuals, although the specific data may differ from individual to individual.”

According to Ascension, the attacker gained access into its systems after someone working in one of its facilities accidentally downloaded a malicious file they thought was legitimate. Ascension said it has no reason to believe it was anything but an “honest mistake.”

“Importantly, we have no evidence that data was taken from our Electronic Health Records and other clinical systems, where our full patient records are securely stored,” the spokesperson said.

Ascension said it doesn’t know exactly what data was potentially impacted and for which patients, but a full review of the potentially impacted files is underway. The full analysis will take time.

“In the meantime, to provide our patients and associates with the greatest peace of mind possible, we are offering complimentary credit monitoring and identity theft protection services to any Ascension patient or associate who requests it, free of charge, and regardless of whether we determine in the future that their data was actually involved in this incident,” the spokesperson said.

If you want to enroll in the free credit monitoring and identity theft protection services, call 1-888-498-8066.

“We want to be clear, however, that this offer does not mean we have determined that any specific individual patient’s data has been compromised. Rather, it illustrates our desire to do everything possible to reassure our patients and associates, regardless of any impact to specific individuals’ data,” the spokesperson said.

Ascension said it is unable to answer questions about whether or not your data is affected, but once the analysis is complete it will follow all applicable laws and regulations to notify anyone impacted and the appropriate regulatory bodies.

“To our patients, associates, and the communities we serve, we regret any disruption or concern you may have experienced as a result of this incident,” the spokesperson said.

Subscribe to the TV5 newsletter and receive the latest local news and weather straight to your email every day.

link