Mississippi Center for Advanced Medicine

The covered entity (CE), Mississippi Center for Advanced Medicine, PC, reported that it experienced a ransomware attack that affected the electronic protected health information (ePHI) of 8,908 individuals. The ePHI involved included names, dates of birth, addresses, telephone numbers, medical record numbers, Social Security numbers, and clinical and health insurance information. The CE failed to provide timely breach notification to HHS, affected individuals, or the media. In response to the breach, the CE strengthened its technical safeguards, revised its policies and procedures and retrained its entire workforce. OCR provided the CE with technical assistance pertaining to the HIPAA Breach Notification Rule.