Medical Business Management

Medical Business Management, the business associate (BA), reported that it was the victim of a ransomware attack affecting the protected health information (PHI) of 1,750 individuals. The PHI involved included names, dates of birth, Social Security numbers, addresses, diagnoses, and financial and other treatment information. The BA notified HHS, affected individuals, the media, and posted substitute breach notice on its website. The BA also provided affected individuals with complimentary credit monitoring services. In response to the breach, the BA implemented additional technical safeguards to better protect PHI. OCR provided the BA with technical assistance regarding the HIPAA Rules.