Health organizations increasingly are targets of cyber-extortion plots aimed at hijacking patients' sensitive personal data, the U.S. Department of Health and Human Services warns.

About 3.6 million records were involved in 146 hack-type breaches of medical organizations made public in 2017 alone, according to the Privacy Rights Clearinghouse, a nonprofit group based in San Diego.

Lawyers themselves were exposed to the horrors of cyber extortion last June when a malicious software called Petya crippled DLA Piper, locking its computers' users out of their devices' data in exchange for a $300 ransom payment, according to reports on ALM affiliate publications.

The cyberattack, which caused three days without phones and email within the global firm's U.S. operations, may end up costing the firm millions of dollars and was part of an international cyberattack that affected organizations from Ukraine to the United States. American hospital operator Heritage Valley Health Systems and pharmaceutical giant Merck & Co. also were targeted in the same Petya attack, according to published reports.

Health care organizations store tens of millions of patients' personal health information, which is highly regulated by the federal Health Insurance Portability and Accountability Act of 1996. But cyber extortion attempts are not uncommon, according to HHS's Office for Civil Rights, which enforces HIPAA on behalf of the federal agency. Breaches of unsecured protected health information must be reported to the agency under federal law.

“Incidents of cyber extortion have risen steadily over the past couple of years and, by many estimates, will continue to be a major source of disruption for many organizations,” according to the OCR's January newsletter. “Organizations that provide necessary services or maintain sensitive data, such as Healthcare and Public Health (HPH) sector organizations are often the targets of cyber extortion attacks.”

To help health care organizations avoid attacks, the OCR provides the following tips:

• Train employees to identify unusual emails and other messages that hackers could use to break into your system.
• Document suspicious activity and review those logs regularly.
• Perform a risk analysis that looks at the entire organization and fix known risks.
• Use anti-malware programs to prevent access by malicious software proactively.
• Implement and test cyberattack recovery plans.
• Encrypt and back up sensitive data.
• Stay on top of new and emerging cyberthreats, perhaps by signing up for governmental alerts known as US-CERT alerts, which are generated by the government's National Cyber Awareness System and received via email or an RSS feed and provide timely information about security issues.