Institute for Women's Health

Institute for Women’s Health, the covered entity (CE), reported that a keylogger virus on its computer network captured information keyed into the CE’s system for more than a month. The protected health information (PHI) of 15,761 individuals was involved in the breach. The types of PHI included demographic, financial, and clinical information. The CE notified the affected individuals and the media. During the investigation, OCR provided technical assistance concerning a risk analysis which the CE subsequently provided. Based on further technical assistance from OCR, the CE updated and implemented technical and procedural changes to prevent a similar event from occurring in the future and retrained its staff.