D. Andrew Loomis MD, Paula Schulze MD,Tammara Stefanelli MD, Christen Vu DO, Anja Crider MD

OCR opened an investigation against several covered entities (CE), D. Andrew Loomis M.D. (AL), Paula Schulze M.D. (PS), Tammara Stefanelli M.D. (TS), Christen Vu D.O. (CV), and Anja Crider M.D. (AC), that shared staff and office space and operated their electronic medical records on a common computer server. On April 21, 2017, the CE's data systems were subjected to a ransomware attack, affecting the electronic protected health information (ePHI) of approximately 9,000 individuals, including clinical and demographic information. PS, TS, and CV stopped practicing in the area and transferred medical records to AL. During the investigation, AL and AC demonstrated to OCR that they performed a breach risk assessment and determined there was a low probability of compromise. They also implemented improvements to the technical security of the facility, changed all workforce members’ credentials, and implemented monitors for its computer server activity.