U.S. Sen. Mark Warner (D-Va.) is asking Universal Health Services (NYSE: UHS) to answer for a recent cyberattack that affected the hospital company’s 400 or so U.S.-based facilities back in September.
Specifically, Sen. Warner is requesting that UHS provide details on the company’s vulnerability management process, third-party risk management policies and cybersecurity protections, as well as other security-related information. He posed those questions to the hospital company in a recent letter, dated Oct. 9.
In his inquiry, Warner also asked for the name of the executive responsible for information security, as well as whether or not UHS has paid or plans to pay any ransom related to the September cyberattack. His aim is to learn more about the situation in hopes of ensuring patient safety going forward.
Headquartered in King of Prussia, Pennsylvania, UHS has 328 behavioral health facilities spread across the US, Puerto Rico and the United Kingdom. It also has 26 acute care hospitals, 42 outpatient facilities and ambulatory care access points, an insurance offering, a physician network and other related service offerings.
On Sept. 27, UHS suffered a presumed cyberattack, which temporarily caused the company to take all of its IT systems offline and rely on back up documentation methods. Only U.S.-based facilities were impacted. UHS has said it has no evidence that any patient or employee data was compromised or stolen as a result of the attack.
Still, Warner told UHS in the letter that the company has a responsibility to keep patients and their information safe while providing services, especially amid COVID-19.
“Patients deserve to know that healthcare systems are secure, particularly as the nation faces a pandemic straining resources nationwide,” Warner wrote in the letter. “When a cybersecurity failure occurs, patients need reassurance that their healthcare provider is committed to learning from and responding to this truly concerning incident, and that it is taking all appropriate steps to help ensure it cannot happen again.”
Warner asked the hospital company to respond to the letter within two weeks.
Behavioral Health Business reached out to UHS to request comment for this story. However, BHB had not yet heard back at the time of publication.