Family Healthcare of Lake Norman

On April 20, 2018, the covered entity (CE), Family Healthcare of Lake Norman, discovered a cyber-attack as the malware was in the process of encrypting information in the CE’s computer system. The CE initially reported that approximately 500 individuals were affected, but after a third party completed a forensic investigation, the CE concluded that there was a low probability of compromise to any PHI. Though the cyber-attack affected the CE’s computer system, the CE’s ePHI was encrypted and password protected. Because the CE determined there was no reportable breach of PHI, and no affected individuals, it did not provide individual notification. Its investigation revealed that the cyber-attack’s likely entry point was via remote desktop connection. To prevent this type of attack in the future, the CE disabled remote access to its computer system. It also converted to a cloud-based practice management and electronic health records software. OCR obtained assurances that the CE implemented the corrective actions listed above.