The covered entity (CE) reported that on June 17, 2017, it was the target of a ransomware attack, affecting electronic files for 19,203 individuals on the CE’s computer server and desktop computer workstations. The affected files contained electronic protected health information (ePHI), including demographic and clinical information. The CE worked with third party experts to investigate the ransomware attack and to recover affected data. The CE is not aware of any improper use, disclosure, acquisition, access, or compromise of e-PHI during the ransomware attack. On the day of the attack, the CE’s records were saved successfully in a daily backup and the CE was able to recover exact copies of all affected ePHI from those systems. The CE’s forensic expert recommended preventative measures, conducted an email phishing test, provided security training to employees, installed an umbrella web filtering system and implemented a two-factor login authentication system. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained assurances that the CE implemented the corrective actions listed.
