J&J MEDICAL SERVICE NETWORK

J & J Medical Service Network, Inc., the business associate (BA), reported that it was the victim of a cyber-attack involving ransomware. This attack affected the electronic protected health information (ePHI) of 17,479 individuals and the ePHI involved included names, addresses, birthdates, Social Security numbers, and clinical information. The BA was able to recover the data and a third-party forensic analysis found no evidence to conclude that the attacker accessed or exfiltrated the data. The BA notified HHS, affected individuals, and the media. Following this breach incident, the BA implemented additional administrative, technical, and security safeguards and retrained its workforce members. OCR obtained assurances that the business associate implemented the aforementioned corrective actions. Further, the BA notified OCR that it had closed its business.