MSK Group

The covered entity (CE), MSK Group PC, discovered on May 7, 2018, that ransomware blocked access to its computer servers which the contained electronic protected health information (ePHI) of 566,236 former and current patients. The ePHI potentially affected included demographic, clinical, and health insurance information. The CE was unable to determine whether ePHI had been copied or transferred outside of the network. The CE timely performed its breach notification obligations. In response to the breach, the CE engaged an information technology firm to continuously monitor its information systems and respond to suspicious activity. The CE also retrained its workforce and implemented substantial technical safeguards, including upgrading firewall protections, reconfiguring servers, and restricting remote access. OCR obtained assurances that the CE implemented the corrective actions listed above and performed its notification obligations.