Don White, RN, DC

On June 30, 2018, the covered entity (CE) discovered that ransomware infected its computer server that stored the electronic protected health information (ePHI) of approximately 2,900 individuals. The types of ePHI involved in the breach included names, addresses, dates of birth, driver’s license numbers, social security numbers, financial information, and medication information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE encrypted all laptop computers and electronic media storage devices, implemented additional information security safeguards, and retrained workforce members. OCR obtained assurances that the CE implemented the corrective actions listed above.