Its failure to disclose the incident was met with backlash, along with the fact that it paid the hackers the ransom they requested and trusted them to delete the data once they received the money. “It’s just ridiculous,” said patient Amber Wietlispach. “You can pay them off, but how do you know? How do you know that they really got rid of your information?”

UC San Diego Health also faced criticism as well as a lawsuit over its handling of a data breach that occurred last winter. The incident was a phishing scam that took place between December and April and led to unauthorized access to certain email accounts.


As a result, cancer patient Denise Menezes, of El Cajon, accused it of negligence, breaching contract and going against state consumer and privacy and medical confidentiality laws in the suit. She also criticized it for taking too long to notify patients, and for lacking procedures necessary to identify the intrusion quickly and claims that the breach violates HIPAA privacy and security rules.

In a recent presentation at RSNA 2021, Erik Decker, chief information security officer for Intermountain Healthcare, recommended that healthcare practices work more closely with IT vendors, consult the Health Industry Cybersecurity Practices (HICP) playbook, conduct mock phishing attacks to learn, and take advantage of multifactor authentication and antivirus protection technologies.

“Cybersafety is a patient safety problem. You look at this insurmountable challenge and think, "how am I supposed to defend against this?” he stated.

Back to HCB News

Health IT Homepage