The University of Mississippi Medical Center will continue to keep clinics closed statewide Wednesday as the center continues to recover from last week’s ransomware attack. Last Thursday, the center noticed irregularities in its system.
“One of our IT systems started not working properly,” said UMMC Vice Chancellor Dr. LouAnn Woodward. “So that was our signal.”
Shamira Muhammad
UMMC remains closed through Wednesday; business leader urges patients to freeze or monitor credit
The attack forced UMMC to shut down its IT network and go into “downtime procedures.” Clinical equipment remained functional, including vital monitors for critical care patients, but all clinics within the center’s statewide system were closed.
Woodward confirmed to SuperTalk that those responsible for the attack made financial demands in order to decrypt the networks. However, she did not confirm any amounts.
UMMC is in contact with those behind the attack and the center continues to work alongside federal agencies, including the FBI. They’re also collaborating with three national vendors that are experts in cyber forensics, recovery and security.
“I applaud UMMC for coming out there and talking to the press about it,” said John O’Hara, president and CEO of the Better Business Bureau serving Mississippi. “Just letting people know, we don't know what's going on yet, but just to let you know to be careful. Maybe it will panic some people, but there are some things you could do to take control of it yourself.”
O’Hara said while it’s understandable to have a fear of confidential medical information appearing on the dark web, he emphasized the risk identity theft carries.
“First of all, check your credit report,” said O’Hara. “Make sure that you're not having someone who's tried to open a line of credit on you, a new line of credit. Another thing is to check your banking statements, check your credit card statements closely.”
He said identity thieves start small, charging very low amounts to test out accounts. He said medical institutions are often attractive to those committing identity theft because of the amount of personal information collected.
“What they want to know is what your date of birth is, social security number, mother's maiden name, a lot of things you use in password protection is out there,” O’Hara said. “So you may want to contact the three credit bureaus and put your credit on freeze. People say, well, why would I do that? It's because if there happens to be information that's compromised, it doesn't usually happen in the first 30 to 60 days.”
According to the U.S. Department of Health and Human Services, the medical center was required to pay $2.75 million in fines for multiple Health Insurance Portability and Accountability Act (HIPAA) violations resulting from a 2013 data breach. At that time, a laptop from the center using only generic passwords was reported stolen and the electronic protected health information of about 10,000 people was exposed. The Office for Civil Rights of HHS discovered that UMMC was aware of vulnerabilities to its IT system dating to April 2005.
O’Hara, who said it could take 18 months to two years to recover from identity theft, believes credit monitoring and freezing credit is a secure way to give patients peace of mind without impacting credit.
“It could make it cumbersome to freeze and unfreeze,” he said. “Sort of like trying to call one of these things that gets thousands of calls a day. It may take you a little longer to do it. They're about as secure as anything you're going to have.”
In a statement, Baptist Medical Center says they are temporarily increasing staff to support UMMC’s immediate needs and any surges in health care demands. UMMC is the state’s only academic medical center and level I trauma center.
UMMC has established a triage line to help patients fill prescriptions and get other urgent care fulfilled. It can be reached at 601-815-0000.