Jemison Internal Medicine

On December 20, 2017, Jemison Internal Medicine, P.C., the covered entity (CE), discovered that files in its electronic medical records (EMR) were encrypted by ransomware. Through its contracted forensic investigator, Altep, the CE found that there was unauthorized access through its remote desktop protocol (RDP) service and that the protected health information (PHI) for 6,550 individuals was exposed. The exposed PHI included names, addresses, birthdates, driver’s license information, social security numbers, insurance information, and medical information. In response to the breach, the CE reset all system passwords, implemented multifactor authentication for all remote access, and reviewed its HIPAA policies and procedures. As a result of this review and OCR’s technical assistance, the CE implemented new policies and procedures regarding its security and risk management program. The CE provided breach notification to HHS, the affected individuals, and the media, and posted substitute notice on its website. OCR obtained assurances that the CE implemented the corrective actions noted above.