Compassion Care Hospice Las Vegas

On October 28, 2017, the covered entity (CE), Compassion Care Hospice Las Vegas, LLC, discovered that an unknown individual gained access to its computer network and server containing 1,128 patients' protected health information (PHI), specifically demographic and clinical information. Although there was no evidence of access to or exfiltration of PHI, the CE could not rule out that PHI was at risk of compromise. Out of an abundance of caution, the CE provided breach notification to HHS, affected individuals, and the media. Following the incident, the CE changed all administrator and user credentials to its computer system, enabled intrusion prevention software and blocked all suspicious internet protocol (IP) addresses, disabled and removed all remote connection software, blocked its public IP address so that it could no longer receive inbound connections, and took both servers offline permanently. OCR obtained assurances that the CE implemented the corrective actions noted above.