Ransomware Assault Leads to 2 Week Shutdown of Operations at TN Medical Clinic

Posted By HIPAA Journal on Could 8, 2023

A cyberattack on Murfreesboro Medical Clinic & SurgiCenter (MMC) in Tennessee compelled the healthcare supplier to utterly shut down operations for round two weeks to include to assault and restore its IT methods. It’s common for healthcare organizations to carry out an emergency shutdown of the community to include a cyberattack and restrict the hurt precipitated, and to function underneath emergency procedures with employees recording affected person data manually whereas methods are out of motion. Some assaults see ambulances diverted and a few appointments canceled for affected person security causes, however the disruption attributable to this assault was way more in depth.

The cyberattack occurred on April 22, 2023, and the community was quickly shut all the way down to include the assault. Third-party cybersecurity consultants have been engaged to help with the investigation and restoration from the assault. MMC mentioned the fast motion taken in response to the safety breach restricted the injury precipitated, and work has continued around the clock to securely deliver methods again on-line and improve safety controls. MMC has been working with cybersecurity consultants and legislation enforcement to analyze the incident and decide the extent of the assault, and whereas these processes have been accomplished, the choice was taken to shut all operations. MMC deliberate to reopen on a restricted foundation on Could 3, 2023, then restore full operations shortly thereafter; nonetheless, the restoration course of took longer than deliberate.

The MMC Pediatric and Inside & Household Stroll-In Clinics at its Garrison Drive location reopened on Could 4, 2023, however all different areas remained closed. On Could 5, 2023, all surgical procedures in its SurgiCenter, Gastroenterology procedures, Laboratory and Radiology companies have been canceled, MMC Now areas remained closed, though telephone traces have been restored. Over the weekend of Could sixth and seventh, MMC Pediatrics resumed regular weekend operations, however MMC Now Household Stroll-In Clinics and Laboratory and Radiology companies remained closed for the weekend. On Monday, Could 8, 2023, operations remained restricted, though some scheduled appointments went forward as deliberate, though laboratory and radiology companies and MMC Now Household Stroll-In areas remained closed.

“Preserving delicate affected person and worker data is of the utmost significance to MMC, however like so many different organizations across the nation and regardless of its finest efforts, MMC has discovered itself because the goal of criminals making an attempt to steal private or firm information. I need to thank our sufferers and workers for his or her understanding and persistence whereas we work to verify our laptop infrastructure is safe and freed from any dangerous software program,” mentioned Joey Peay, CEO of MMC. “We now have labored diligently to speak closures with all sufferers in a well timed method utilizing all strategies of communication at our disposal… we apologize for the vagueness of our current communications, however we didn’t need to do something that may impede legislation enforcement’s investigative efforts.”

Whereas the precise nature of the cyberattack has not been disclosed, that is understood to be a ransomware assault involving information theft. The extent to which affected person information has been affected is being investigated and MMC will make additional bulletins and problem notifications as obligatory when the investigation concludes.