NY AG: Refuah must invest $1.2M to secure patient records after cyberattack
The New York State Attorney General's Office has hit health provider Refuah with fines and demands that it update the way it protects patient records after a 2021 ransomware attack exposed the personal information of some 250,000 people who had used the federally qualified health centers.
An assurance, or agreement, with Refuah was reached Dec. 29.
Refuah's main health center is in Spring Valley, with offices in Spring Valley/Monsey, Hillcrest/Nanuet, South Fallsburg and Liberty. Mobile units also serve the Hudson Valley region.
What Refuah will do
Refuah has agreed to invest $1.2 million to develop and maintain stronger information security programs to better protect patient data.
Refuah is also required to pay $450,000 in penalties and costs to the state, with $100,000 of that to be suspended when the company security program investment is complete.
Further security measures include encrypting patient information and monitoring all activity on the company's networks.
Refuah notified former and current patients of the breach, according to an April 29, 2022 statement, and offered credit monitoring for those whose Social Security numbers may have been impacted.
"Over the next four years, RefuahHealth will make a meaningful investment in our cybersecurity," spokesperson Amanda Salzman said Monday. "We remain committed to maintaining the privacy of personal and protected health information in our possession."
How the leak happened
The AG's Office pointed to how Refuah’s poor data security fed the ability of hackers to launch their scheme in May 2021.
The attackers were able to gain remote access by getting ahold of administrative credentials associated with a Refuah account used by a former IT vendor. Even though the vendor hadn't worked with Refuah since 2014, according to the AG's Bureau of Internet and Technology investigation, the account used by the vendor hadn't been deleted or disabled.
In fact, the credentials had not been changed for at least 11 years, the AG reported.
By the time the time the hack was discovered, on June 1, 2021, about a terabyte of data was accessed, the AG report states. But Refuah didn't have the technology in place to identify what files had been taken.
This article originally appeared on Rockland/Westchester Journal News: Refuah clinic ransomware attack: NY Attorney General issues fines
