Good Care Pediatric

OCR opened an investigation of the covered entity (CE), Good Care Pediatric, LLP, after it reported that a Trojan Horse virus affected one computer device and caused patient billing files to be accessible by unauthorized individuals online from January 1 through April 3 of 2014. The incident affected 2,300 individuals. The types of electronic protected health information (ePHI) involved included patients’ names, addresses, telephone numbers, dates of birth, and diagnosis codes. As a result of the breach, the CE shut down the external access to the unsecured computer device, conducted a full virus and malware scan of all of its computer devices, and changed passwords for its router, firewall administration, and workforce members. The CE also encrypted all patients’ billing files, retrained its workforce members with respect to its HIPAA policies and procedures, and updated its risk analysis and risk management plan. OCR provided the CE with technical assistance regarding the execution of risk analyses and the implementation of procedures for guarding against, detecting, and reporting malicious software.