ELLIOT J MARTIN CHIROPRACTIC

An unauthorized user established a user account with administrative privileges on the covered entity's (CE) computer system which contained the electronic protected health information (ePHI) of 1,200 patients. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ran malware detection software and reviewed software logs that showed activities from the CE's computer. The CE changed its Internet Protocol (IP) address, router, passwords and installed a physical firewall on its computer system. The CE also changed its policy so that it does not request or maintain patients’ Social Security numbers. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a risk analysis, implement a corresponding remediation plan, and implement certain improvements to its processes regarding information system activity review and information access management.