Lee Rice D.O., Medical

Malware was installed by cyber-intruders into PrognoCIS, the medical records system of the business associate (BA), Bizmatics, Inc. The breach affected approximately 2,473 individuals who were patients of the covered entity (CE), Lee Rice D.O. Medical Corporation d/b/a Lifewellness Institute. The types of protected health information (PHI) involved included full names, addresses, dates of birth, phone numbers, sex, marital status, social security numbers, claims information, diagnoses/conditions, lab results, and medications. The CE provided breach notification to HHS, affected individuals, and the media and also provided substitute notice. In response to the breach, the BA notified and cooperated with the FBI in its investigation. In addition, the BA consulted with an independent cyber-security firm to assess the extent of the breach and to implement additional protective measures to prevent a similar breach from occurring in the future. OCR obtained assurances that the CE and BA implemented the corrective actions noted above.