Clinton County Board of Developmental Disabilities

On May 5, 2017, the covered entity (CE) reported that on March 16, 2017, it discovered that a person accessed its computer server and deployed ransomware, which prevented the CE’s employees from accessing data on its server. The server contained patients’ clinical information, diagnoses, conditions, and other treatment information and affected approximately 1,243 individuals. The CE provided notification to HHS, affected individuals, and the media. It also reported the matter to the Clinton County Ohio Prosecutor’s office and the Clinton County Administrator. To prevent similar breaches from happening in the future, the CE decommissioned the affected server, migrated to a cloud solution, and upgraded its anti-virus software to a managed solution monitored by help desk staff. The CE also updated its policy and procedure regarding passwords, implemented its software restrictions policy, and trained its workforce on its policies and procedures regarding HIPAA and safeguards for PHI. OCR obtained documented assurances that the CE implemented the corrective actions noted above.