Green Clinic is providing an update to our patients, community and local media regarding a cybersecurity incident that has significantly disrupted our computer systems and normal operations since Friday morning.
At approximately 6:30 a.m. on Friday, Oct. 2, Green Clinic identified a cybersecurity incident affecting our computer systems and network. Upon discovery, we immediately halted computer and network-related operations and began working to identify, contain and isolate the threat.
We subsequently determined that Green Clinic was the victim of a ransomware attack associated with a threat actor identifying itself as “Wall Street,” or an affiliate thereof. The attack encrypted files and systems throughout our network, leaving our staff without access to many of the electronic systems we rely upon during normal operations, including patients’ electronic medical records.
Since the incident was discovered, our team has been working around the clock to assess the scope of the attack, secure our environment and begin the process of safely restoring operations.
We are continuing to investigate the incident with the assistance of outside cybersecurity and other resources.
Green Clinic has notified the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) of the attack and is prepared to cooperate with federal, state, and local law enforcement and other agencies as appropriate throughout the investigation and recovery process.
Our investigation into the full scope and impact of this incident remains ongoing, including an assessment of information that may have been accessed or acquired without authorization. We recognize that patients will understandably have questions about the security and privacy of their information. We are not going to speculate about the extent of the incident while that investigation is still underway, nor do we want to provide assurances that we cannot yet substantiate.
If our investigation determines that personal or protected health information was affected, Green Clinic will provide the notifications and information required by law. We will also provide additional public information as facts are established and can be responsibly communicated.
Patient Care and the Path Forward
Over the coming days, Green Clinic will be implementing a new clinical system that will allow our providers and staff to begin documenting and managing patient care electronically while recovery efforts involving our affected systems continue.
Our employees will spend the remainder of this week and the beginning of next week preparing for and training on this system. Because this work requires the participation of our clinical and administrative staff, Green Clinic will have very limited capacity to see patients during this transition period.
We are currently planning to begin using the new system and resume broader patient care on Wednesday.
We want patients to understand that this transition does not immediately restore our historical medical records or existing appointment schedules. When we begin seeing patients more broadly, our staff may not know in advance who is scheduled to arrive for an appointment, and our providers may not initially have access to the patient’s prior Green Clinic medical record.
Despite those limitations, beginning Wednesday, we intend to make every reasonable effort to see and care for patients who present to Green Clinic. Patients who had appointments previously scheduled for Oct. 14 or later should plan to arrive at their originally scheduled date and time unless they are contacted and told otherwise.
We ask patients to bear with us during this transition. Visits may take longer than usual, patients may be asked to provide information that we would ordinarily already have available, and some services may remain unavailable. Patients who are able to do so are encouraged to bring their insurance card, identification, medication bottles or an up-to-date medication list, and any other medical information that may be helpful to their provider.
Between now and Oct. 14, our ability to provide patient care will remain extremely limited while our staff focuses on preparing for this transition. Patients experiencing a medical emergency should call 911 or seek care at the nearest emergency department. Additional information regarding services that remain available during this period will be communicated through Green Clinic’s official channels.
To Our Patients and Community
We recognize the seriousness of what has occurred and the concern, frustration, and disruption this incident creates for our patients. People entrust Green Clinic not only with their medical care, but also with highly personal information. We do not take that responsibility — or the questions this incident raises — lightly.
There are questions that we cannot responsibly answer today while the investigation is still underway. We do not want to speculate or provide assurances that later prove to be incorrect. As facts are established, we are committed to communicating material information to our patients and community as clearly and responsibly as we can.
This incident has significantly affected our ability to operate as our patients expect us to. Appointments have been disrupted, access to care has been limited, and our staff is having to rebuild processes that ordinarily depend upon systems and information that are presently unavailable. We understand that
these disruptions have real consequences for our patients, and we are sorry for the difficulty they are causing.
Our physicians, advanced practice providers, nurses and staff continue working under extremely challenging circumstances to prepare for the safe resumption of broader patient care.
Our focus now is on protecting our environment, determining the full scope of what occurred, safely establishing the systems necessary to care for our patients, and returning Green Clinic to normal operations. We will provide additional information as we are able to verify it.
