Lutheran Social Services of South Central Pennsylvania

This case involved a hacking incident on the covered entity’s (CE) network server. A Trojan virus was discovered running under an administrative account on a remote access server. No data loss was actually discovered, but potentially 7,300 records may have been vulnerable. The types of protected health information (PHI) potentially breached included demographic, financial, and clinical information. The CE engaged a forensic consulting team to verify the scope and impact of the malware and to clean the system. The CE installed more effective virus detection software, trained and educated users regarding data security, and made adjustments to data storage policies. OCR confirmed that the CE took all appropriate corrective action.