Dr. Melissa D. Selke

An unknown third party infected the covered entity’s (CE’s) information system with a computer virus that prohibited access to 4,277 patient files. The protected health information (PHI) affected by this incident included patient’s demographic, financial, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE changed and strengthened password requirements, implemented new technical safeguards, and revised its HIPAA policies and procedures. The CE also offered one year of free credit monitoring and a toll free number for affected individuals. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to perform a risk analysis and establish a risk management plan that addresses all potential risks and vulnerabilities of the CE's IT environment with respect to uses and disclosures of electronic PHI (ePHI), particularly unauthorized users accessing ePHI.