Don’t Be the Next Company Sending Out a Notice of Data Breach Letter

Don’t Be the Next Company Sending Out a Notice of Data Breach Letter

Why do so many companies fail to take data security seriously? From what we have seen, companies fail to take data cybersecurity seriously enough for the following reasons:

• They believe that ensuring compliance with a security framework, such as FISMA or NIST, is enough.
• They haven’t experienced a security breach in the past, so they don’t believe they’ll deal with a security breach in the future.
• They don’t want to deal with the hassle and/or don’t have the knowledge to find and implement the right security solutions.

Does anything listed above sound familiar? Most businesses are surprised when reality strikes them and they must write their clients, consumers or patients a letter with the subject line: Notice of Data Breach.

To help you get prepared for if disaster strikes, we have created a FREE Cybersecurity Incident Response Plan template that you can implement in to your business, which you can find at the end of this post.  

Yet another example of a company’s failure to take preventive measures against computer security breaches

It goes on to outline the when, what, and how they plan to resolve this “incident”.

1. On March 9, 2018, The Oregon Clinic learned that an unauthorized third-party accessed an email account.
2. The Oregon Clinic immediately disabled the account and began an investigation to determine what had occurred and whether protected health information (PHI) may have been affected.
3. Cybersecurity experts were engaged, including a digital forensics firm, to determine the nature and extent of the incident.
4. On April 19, 2018, the investigation determined that PHI may have been affected. This information included patient’s name, date of birth, and certain medical information (that may include medical record numbers, diagnosis information, medical condition, diagnostic tests performed, prescription information and/or health insurance information).
5. They determined that the incident was restricted to one email account and did not affect any other aspect of The Oregon Clinic’s network.
6. In addition to their investigation, they are offering additional steps patients can take to protect personal information. This is an identity monitoring service for 12 months at no cost through Experian.
7. And, lastly, they give recommendations to protect your personal information, (which is a long and arduous task as anyone that has had their personal information/identity put at risk knows). 

In an article by Scot Gudger, CEO at The Oregon Clinic, he issues the following statement to Health Data Management:

“We are very sorry this happened and apologize to the patients who have been affected by this incident. We value our patients and will continue to work closely with cybersecurity experts to remediate this situation, and, most importantly, are taking steps to help prevent similar incidents from happening in the future.”

This mindset of “Oh we’re sorry, and NOW we will take steps to prevent this” is becoming less and less acceptable in a world where hackers are always looking for that one company with an out of date AV or Firewall, or no IDS/IPS, or the plain and simple mindset of “it won’t happen to us”.

Don’t let yourself become another number in the world of cyber-attack statistics. Your staff and customers deserve the best from you. 

If you’re looking to be more proactive in your cybersecurity incident response plan, we’ve created an outline of five critical components yours should have. Read more about it below.