Allergy, Asthma & Immunology of the Rockies

On June 17, 2016, Allergy, Asthma & Immunology of the Rockies, P.C., the covered entity (CE), discovered that its computer system was hacked and found evidence of ransomware and unknown accounts on the system. The CE determined that because there was unauthorized access to the system, there was a likelihood that electronic protected health information (ePHI) stored on the system had been compromised by the hackers. The compromised ePHI included the demographic, financial and clinical information of up to 6,851 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE replaced the infected computer hard drive, rebuilt its system, and implemented a virtual private network (VPN) to protect against future incidents. OCR’s investigation resulted in the CE revising its procedures for safeguarding ePHI and protecting against malicious software. The CE also updated its risk analysis and risk management plan based on OCR’s technical assistance regarding the Security Rule’s requirements.