Advanced Spine & Pain Center

On September 27, 2017, the covered entity (CE) notified OCR that an unauthorized individual accessed the CE's computer server, affecting 8,352 individuals' demographic, clinical, and healthcare payment information. The CE also provided breach notification to affected individuals and the media. To address the breach, the CE removed the server from its network and disabled the account created by the unauthorized individual. Additionally, the CE engaged a third party vendor to provide software patches, implemented periodic patch reports to ensure patches are consistent, and encrypted its wireless network and email. OCR provided technical assistance regarding the CE's risk analysis and risk management plan.