Marin Healthcare District

Ransomware infected systems operated by the covered entity’s (CE) business associate (BA), Marin Medical Practice Concepts, Inc. A third party forensic firm hired to investigate the incident found no evidence that patients’ personal, financial, or health information was accessed, viewed, or transferred. However, during the restoration process, one of the BA’s backup systems failed, causing the loss of protected health information (PHI) documented by the CE’s physicians during the period from July 11, 2016 through July 26, 2016. The PHI included vital signs, limited clinical histories, documentation of physical examinations, and records of the communications between patients and their physicians during their visits. OCR consolidated this review with an existing review of the BA involved in this case.