Family Physicians of Old Town Fairfax

On May 19, 2018, the covered entity (CE) experienced a ransomware attack that infected its fax server. The CE removed the fax server from the CE’s office and shut down all workstations. Through counsel, the CE engaged an outside firm to conduct a forensic investigation and found that a malicious actor gained access to the CE’s systems through an open RDP port using an account belonging to one of the practicing physicians. The malicious actor deployed “Paradise” ransomware which is not known to have the capability of deleting or exfiltrating data. Finally, the investigator reported that the malicious access to the CE’s network was limited to deploying the ransomware and accessing certain top level folders, which the CE confirmed did not contain PHI. After a full investigation and risk analysis, the CE concluded that the ransomware attack did not constitute a breach and that there was a low probability of compromised PHI. OCR reviewed a copy of the CE’s risk assessment, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained a copy of the business associate agreement between the forensic investigating firm and the CE and obtained assurances tha