'Everything is gone': Patients demand answers after allergy clinic shuts down due to 'cybersecurity event'

EDMOND — An allergy clinic in the northeast metro area has abruptly closed its doors after an alleged cybersecurity attack, leaving numerous patients outraged and local officials concerned.

The Oklahoma Institute of Allergy, Asthma and Immunology shut down in early May after what its staff claimed was a “cybersecurity event.” But the FBI says it has received no formal report from the clinic of a cybersecurity attack, and representatives with the Better Business Bureau are now closely examining complaints against the clinic.

Dr. Amy Liebl Darter, an allergist and immunologist, told multiple TV news stations in mid-May that problems began after she and her husband installed an iPhone app in February. Afterward, they said issues arose with the clinic’s email, electronic medical records and office phones.

Darter did not describe the problem as ransomware but told News 9 they were soon “locked out of everything,” including the clinic’s Facebook page.

“Our patients, unbeknownst to me, are still getting text messages from our electronic medical record telling them to come for appointments,” Darter told KFOR. “They’re still able to call the main line, yet we have no access to that.”

'Everything is gone'

Patients have left angry messages on the clinic’s social media, saying they are going without medications, inhalers and injections they relied on the clinic to provide.

“I went there today to try and fill my daughter's prescriptions. No one is there, no one will answer the phone, no one will help or give guidance. Is this not patient abandonment?” one person wrote last week in a comment underneath the clinic’s February Facebook post.

Dozens of people expressed frustration that they could not reach staff members and had been provided no advance notice of the clinic’s closure.

“This office is permanently closed,” another person wrote last Monday. “There are no phones, no computers, no paper medical records and no staff here. I found that out at my 8:15 a.m. appointment this morning. Everything is gone.”

More: Oklahoma experts explain how allergy shots work

A notice posted to the doors of the clinic reads: “Regrettably due to the magnitude of the event there could potentially be a time delay in notification as information may be difficult to access.”

The notice also said that future access to the clinic would be by appointment only, but that patients needing injections to fight allergies or treatments for infusion and biologic concerns would continue to receive them.

“Please be patient as we will have limited access to your records in paper form until the proper authorities are able to decipher the information to help remedy the situation,” the clinic said in the statement.

Darter and her staff did not return requests from The Oklahoman for comment by press time.

"I just want to reassure everybody that this breaks my heart," Darter told KOCO-TV. "I've been in practice for about 20 years, and this breaks my heart that we can't effectively take care of patients right now in a safe manner."

More: Why are my allergies so bad? Trees pollen levels, experts say.

FBI says cyber breach has not been reported to them, despite claims

Darter told multiple news publications earlier this month she submitted information to the FBI, but officials with the agency dispute her claim.

“We are certainly aware that that’s what the clinic is saying, but a formal report of a cyber breach hasn’t been reported to us,” Kayla McCleery, public affairs specialist with the FBI, told The Oklahoman on Tuesday.

McCleery said anyone who believes they were the victim of a cyber breach should call the FBI immediately or report the incident online to the FBI’s Internet Crime Complaint Center.

KOCO-TV reported the clinic had posted an additional notice to its doors in recent days, saying the Department of Justice and the Department of Defense were “actively investigating” the alleged cyber breach. But this notice was no longer posted Tuesday afternoon when The Oklahoman visited the property.

Related: Hacks on hospital records are surging. Here's why your medical data is vulnerable.

The Oklahoma Institute of Allergy, Asthma and Immunology currently has a C rating from the Better Business Bureau, a nonprofit focused on consumer protection and marketplace integrity.

Staff with the Better Business Bureau’s central Oklahoma office said they are now reviewing multiple complaints against the clinic, most of which concern billing.

“Those are in progress right now, but our investigations team is taking a closer look at that business to see what other information they might uncover,” said Casey Farmer, vice president of marketing for the Better Business Bureau’s central Oklahoma office. “Anything that’s found from that investigation will be posted on the (clinic’s) public profile.”

KOCO-TV also reported a lawsuit filed in April against Darter, in which the AmerisourceBergen Drug Corporation alleges she failed to make payments amounting to more than $1 million owed to the pharmaceutical company.

This article originally appeared on Oklahoman: Oklahoma Institute of Allergy in Edmond abruptly closes