Emergence Health Network

The covered entity (CE), Texas Health & Human Services Commission, detected unauthorized remote login activity from Asia to a computer server belonging to a business associate (BA), Emergence Health Network, which had been compromised by a brute force attack. The attack potentially affected the names, addresses, dates of birth, demographic, financial, clinical, and treatment information of approximately 11,000 individuals being discharged from El Paso County Jail. Following the breach, the BA retired outdated software, implemented new policies and procedures to require regular patching of software, installed a new intrusion protection detection system, updated firewalls, strengthened configurations on servers, and implemented internet protocol filtering. It also implemented a new training program for workforce members. Following OCR’s investigation, the BA updated its Breach Notification Policy.