Malware Attack Forces South Carolina Health System AnMed to Close 79 of 106 Facilities
AnMed shut most of its clinics after a malware disruption hit its network; emergency rooms stayed open and physician offices began reopening Tuesday.
Editor's Note ·
- Correction:
- This article was tagged 'ransomware' and 'data breach.' None of the four cited sources characterize the incident that way: AnMed and all outlets consistently describe it only as a 'malware' disruption, HIPAA Journal reports investigators had not yet determined 'to what extent, if any, patient data was involved,' and no threat group had claimed responsibility as of the latest cited reporting. The 'ransomware' and 'data breach' tags should be treated as unconfirmed pending updated reporting; the article body itself does not make either claim.
Overview
AnMed, a nonprofit health system serving upstate South Carolina and northeast Georgia, temporarily closed dozens of clinics and offices this week after a malware attack disrupted its computer network, phone lines and internet connectivity, according to The Record. The health system, which operates four hospitals and more than 60 physician practices, first disclosed the disruption in a statement published Sunday, according to The Record.
What We Know
AnMed confirmed the incident directly, stating: “We are currently experiencing a cybersecurity disruption involving malware that is impacting our network,” according to Fox Carolina.
On Monday, July 27, the disruption forced the closure of 79 of the system’s 106 facilities, according to HIPAA Journal. Closed locations included AnMed Medical Group physician offices and AnMed Imaging Services, while AnMed Urgent Care, AnMed Kids Care, AnMed Integrated Therapy and AnMed Laboratory Services locations remained open, according to HIPAA Journal. Emergency departments stayed open throughout, with care teams continuing to treat patients on site, according to Fox Carolina.
With computer systems, phone lines and internet connectivity down, staff shifted to paper documentation, relying on handwritten orders and results, according to Fox Carolina. Lab work, imaging and medication processing continued but took longer due to the manual workflow, and employees used personal cell phones for interdepartmental communication since internal phone systems were down, according to Fox Carolina. Scheduled appointments and elective procedures were postponed pending direct contact with affected patients, according to HIPAA Journal.
The FBI’s Columbia Field Office and the South Carolina Law Enforcement Division are assisting with the investigation, according to Fox Carolina. AnMed said in a statement: “We are coordinating closely with emergency medical services, regional hospitals and public safety partners to ensure patients continue to receive the care they need in the most appropriate setting,” according to The Record.
By Tuesday, July 28, AnMed began reopening physician offices for scheduled appointments, according to WGOG. AnMed Kids Care and all AnMed Urgent Care locations remained open for walk-in visits, while phone, internet and computer systems stayed offline, according to WGOG. The health system asked patients to bring all medications in their original containers to appointments and be prepared to confirm their medical history, according to WGOG.
What We Don’t Know
AnMed said “the forensic review is still in its early stages” and that it was “not yet able to provide additional details about the nature or scope of the incident,” according to WGOG. As of HIPAA Journal’s July 27 report, investigators had not determined “to what extent, if any, patient data was involved,” and no threat group had claimed responsibility, according to HIPAA Journal. AnMed has not disclosed a timeline for full system restoration.