Coastal Cape Fear Eye Associates

On December 5, 2017, the covered entity (CE), Coastal Cape Fear Eye Associates, P.A., discovered that a folder in its shared computer drive was infected with ransomware due to a phishing attack. The types of protected health information (PHI) in the shared drive included patients' names, addresses, dates of birth, phone numbers, Social Security numbers, insurance card information, driver’s license information, Medicare information, email addresses, ethnicities, emergency contacts, medical histories, medications, medical diagrams, and billing and payment histories approximately 925 individuals. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach. Following the breach, the CE installed new hard drives, risk-ware protection updates, and operating system updates, and also restored backups and reset firewall settings. Additionally, the CE retrained its workforce, increased the frequency of trainings, and limited employees’ access to social media websites and non-work related websites. The CE also updated its HIPAA policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above. On April 3