Community hospital in Colorado thwarts ransomware attack, says patient data is safe
A small community hospital in Colorado confirmed on Tuesday that it was the target of a cyberattack that forced it to shut down its IT systems, in what is being framed as a successful defense against an attempted ransomware event.
Family West Health, a 25-bed facility in rural Fruita, said in a press release that, earlier this week, it detected a cybersecurity event immediately, forcing it to deploy system isolation protocols to stop the spread—typically involving turning off the Internet to disconnect any devices or systems infected with malware.
The attack, which had all the hallmarks of ransomware, did not disrupt patient care at the facility. However, it did force staff to operate on backup procedures.
So far, Family West Health said it has no evidence that patient data was accessed, encrypted or otherwise taken offsite.
It stated that it brought systems back online once they were determined to be safe, and so far has no reason to believe that it suffered any data loss.
“Our top priority is protecting the sensitive information entrusted to us by our patients, staff, and community,” said Derek Biddle, senior director of IT at Family West Health. “We’re taking a cautious approach as we confirm that all systems are secure and fully operational.”
The group said it is still undergoing forensic review as a precautionary measure; however, all attempts to invade its network appear to have “been successfully blocked.”
The incident appears to have had no impact on other healthcare providers in the area.
As for how it thwarted the invaders, a spokesperson for the facility credited staff for successfully disconnecting critical patient care services, such as radiology.
Not a data breach under HIPAA
An investigation into the incident is still underway, and details on the vector and scope of the attack were not revealed. However, assuming the defenses held and patient information—including names, addresses, contact information and medical records—were not compromised, the event will not require reporting and notifications under the terms of the Health Insurance Portability and Accountability Act (HIPAA).
The hospital said it's currently seeking to confirm that the incident is over and poses no more threat to the facility.
HealthExec reached out to Family West Health for more information.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.