Colonial Behavioral Health

Colonial Behavioral Health, the covered entity (CE), reported that it was the target of a ransomware attack that compromised the protected health information (PHI) of 29,930 individuals. The PHI involved in the incident included names, addresses, dates of birth, drivers’ license numbers, social security numbers, diagnoses/conditions, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. Upon discovering the incident, the CE updated its HIPAA policies and procedures to prevent future security incidents and implemented new administrative and technical safeguards.