Ferris State University MI College of Optometry

An unauthorized person evaded the network security of Ferris State University Michigan College of Optometry on December 1, 2011, and placed a malware program on the computer Ferris uses to operate its website, which had the technical ability to access its electronic files on certain network servers. The breach of electronic protected health information (ePHI) affected approximately 3,947 individuals and included patients' names, dates of birth, Social Security numbers, addresses, diagnoses/conditions, financial claims information, clinical information, and other treatment information. The covered entity (CE) provided breach notification to HHS, affected individuals, and the media and posted substitute notification of the breach incident on its website. The CE created a dedicated call center regarding the breach and also offered one year of free credit monitoring to individuals whose social security number was involved in the breach. Following the breach, the CE engaged an outside forensic security firm to conduct an internal investigation, installed the latest operating systems and patches to its network asset and web server, and applyed the latest version of antivirus and malware