Mind and Motion

The covered entity (CE), Mind and Motion, discovered that all the files and applications on its server had been corrupted with an encrypted extension. The covered entity immediately started an investigation which found that a malicious key logger and spam email application had been installed on its server. The breach affected approximately 16,000 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, gender, Social Security numbers, medical diagnoses, insurance information, and medical records, The CE notified OCR, affected individuals, placed substitute notices on its website, and notified the media. In response to the breach, the CE reset all passwords, updated it password management policy, encrypted its server and all computers, and provided HIPAA training to all staff members. OCR provided technical guidance to the CE regarding the implementation of a risk management plan. OCR obtained assurances that the CE implemented the corrective actions noted above.