During an investigation of a malware attack on its computer server that hosts its electronic medical records, in March of 2018, the covered entity (CE) discovered that an unauthorized person accessed the server on September 27, 2016. The breach affected approximately 538,127 individuals and the types of protected health information (PHI) involved included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE implemented its policies and procedures for contingency planning, data backup, disaster recovery, and emergency mode operations. OCR reviewed the CE's policies and procedures to ensure compliance with the Privacy and Security Rules. Following the breach, the CE implemented increased password controls. OCR obtained assurances that the CE implemented the corrective actions stated.
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · data_types: [] to ["names","health"] · backfill source
2026-09-25 · records_basis: empty to hhs · backfill source
2026-09-25 · records: empty to 538127 · backfill source
2026-09-25 · summary: empty to During an investigation of a malware attack on its computer server that hosts its electronic medical records, in March of 2018, the covered entity (CE) discovered that an unauthorized person accessed the server on September 27, 2016. The br · backfill source
