New Jersey Hospitals Hit by Ransomware Have Insurance and Pay

In the early part of this month, Hackensack Meridian Health—a network of 17 medical centers and clinics across the Northeastern state of New Jersey—were added to a growing list of clinics and hospitals hit by ransomware attacks. According to Patch.com in a Dec. 17, 2019 article, the health care system decided to bend to the demands of the hackers and pay a significant fee to regain access to their computer systems.

Ransomware is software which, when introduced, locks up these systems until such a time as a sizable payment is made.

The Hackensack Meridian clinics and hospitals hit by ransomware were covered by cybersecurity insurance. This coverage might have largely offset the costs involved in meeting the monetary requests of the network attackers. The amount paid out has not been released to the public and will likely remain confidential. This response to the monetary demands is not generally recommended.

How Hospitals Hit by Ransomware Were Affected

As indicated by the Patch.com report, the cyberattack rendered Hackensack Meridian Health’s computer system relatively useless for approximately two days. During this time, the network was forced to rely on what paper records they had. They rescheduled at least 100 non-emergency surgical or other procedures for a later date in response to the data freeze.

No effort was made by the 17 hospitals in the network to send patients to other facilities. There was also no decline in the number of patient visits to the associated emergency rooms. The 17 hospitals in this network include Hackensack University Medical Center, Jersey Shore University Medical Center, and JFK Medical Center.

In an article posted by app.com on Dec. 13, 2019, concerning the cyberattack, a story was cited in which a patient spent three hours at a routine doctor visit delayed by the necessity of filling out paper forms for medical history, getting the need for lab work relayed successfully, and delivering handwritten prescriptions to the pharmacy. The likelihood this case was a stand-alone event in the face of a shut-down computer system is slim.

According to a separate report on the ransomware attack posted by healthcareitnews.com, as far as anyone in the administration is aware, there has been no breach to the confidentiality of electronic medical records and personally identifiable information (PII) that might be part of those records.

In the aftermath of the ransomware incident, Hackensack Meridian Health has invited the U.S. Federal Bureau of Investigation (FBI) as well as local law enforcement and regulatory bureaus to investigate. In the event of breaches such as these, the FBI tends to hold the position that hackers should not have their monetary demands met. While it is likely that having a cybersecurity insurance policy affected the decision to pay in this case, there is no guarantee that computer systems will be unlocked once the payment has been made.

Regardless of whether their payment was generally ill-advised, the healthcare network has indicated that it was made. Their primary computer system is now completely functional while other aspects of it may take more time to reinstate—a job they are presently working on.

Join a Free Hospital Ransomware Attack Class Action Lawsuit Investigation

If you were a patient at a hospital or healthcare facility affected by a ransomware attack that impacted your medical care, you may qualify to join a hospital ransomware attack class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.