FABEN Obstetrics and Gynecology

The covered entity (CE), FABEN Obstetrics and Gynecology, discovered on November 21, 2018, that ransomware had infiltrated electronic protected Health Information (ePHI) on its information system, affecting the demographic, clinical, financial, and health insurance information of 6,092 individuals. The CE provided timely notice of the breach to affected individuals, to the media, and to HHS. In response to the breach, the CE encrypted its computer servers, revised procedures regarding virtual private network (VPN) pathways for remote users, enhanced backup procedures, strengthened user termination procedures, and retrained employees on phishing scams and password protection. The CE is also working with its legal counsel and a third party consultant to conduct a HIPAA risk analysis, revise policies, train workforce members, and implement a risk management plan. OCR obtained assurances that the CE implemented the corrective actions listed above and performed notification obligations.