Greigh I. Hirata M.D. Inc, dba. Fetal Diagnostic Institute of the Pacific

On August 30, 2018, the covered entity (CE), Fetal Diagnostic Institute of the Pacific, in Honolulu, Hawaii, reported that two of the computer servers on its system were affected by a ransomware attack, affecting 40,800 individuals. The types of protected health information (PHI) involved in the breach included demographic and clinical information. The CE found no evidence that patients’ PHI was impermissibly disclosed or accessed. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE implemented new technical safeguards, including firewall and related protection services, antivirus and online threat active monitoring, and a tool for remote management of security patches and updates. The CE also retrained its workforce and implemented risk analysis and risk management plans as recommended by its security company. OCR obtained documentation including the CE’s revised policies and procedures and its new employee orientation packet relevant to this breach investigation and obtained assurances that the CE implemented the corrective actions listed above.