Center for Facial Restoration

The covered entity (CE), The Center for Facial Restoration, reported that it was the victim of a ransomware attack affecting the electronic protected health information (ePHI) of 3,600 individuals. The ePHI involved included names, addresses, dates of birth, driver’ license numbers, Social Security numbers, financial and claims information, diagnoses/conditions, and medications prescribed. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In response to the breach, the CE implemented additional technical safeguards, drafted new policies and procedures, and retrained its workforce. OCR provided the CE with technical assistance regarding the HIPAA Breach Notification Rule.