Bluetail Medical Group

On August 1, 2017, the covered entity (CE), Bluetail Medical Group, discovered that ransomware had been installed on a computer server storing 4,026 individuals' x-ray images, names and dates of birth. The ransomware blocked all files with encryption, and the hackers sent an email asking for bitcoin in exchange for the encryption key. Following the breach, the CE immediately removed the malware and recovered the lost data, installed new virus-protection software, and improved safeguards through encryption, server monitoring, and implementing a cloud-based backup for its server. The CE provided breach notification to HHS, affected individuals, and the media. The CE also retrained its staff on security measures. OCR obtained documented assurances that the CE implemented these corrective action steps.