Blaine Chiropractic Center

On or around May 10, 2016, the covered entity’s (CE) office manager noticed that its computer server was crashing and programs were running slowly. The CE found that its new patient record management system created and hid an administrative account that was using a very weak and predictable user ID and password. This administrative account was used to hack the CE’s server. The protected health information (PHI) on the server included patients’ full names, addresses, telephone numbers, appointment activity, clinical care notes, insurance information and for 51 of these affected individuals, their social security numbers. Approximately 1,945 individuals were affected by this breach. The CE provided breach notification to HHS, affected individuals, and the media and offered credit monitoring free of charge for one year. Following the breach, the CE removed the unauthorized account and application. The CE retained a forensic expert and provided OCR with a copy of the forensic report. OCR obtained assurances that the CE implemented the corrective actions listed above.