MetroHealth System

The MetroHealth System, a covered entity (CE), reported that it was the victim of a cyber-attack affecting the protected health information (PHI) of approximately 981 individuals. In addition, MetroHealth discovered that its antivirus protection was disabled by an employee of its business associate (BA) General Electronic Company, when the employee was performing a complex software update. Four files became infected with malware while the antivirus protection was disabled. The PHI involved in these breach incidents included names, dates of service, medications prescribed, and clinical information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE implemented additional technical and security safeguards to better protect its PHI. OCR obtained assurances that the CE implemented the corrective actions noted.