NORTH ATLANTA MEDICAL CLINIC

On November 8, 2018, the covered entity (CE) discovered that an unauthorized third party encrypted 2,800 patients' electronic health records via a ransomware virus and the third party then attempted to extort the CE. The type of protected health information (PHI) involved in this breach included demographic and claims/billing information, including Social Security numbers. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE strengthened its technical safeguards by installing antivirus solutions and purchasing firewall protection. It also implemented biannual HIPAA security training for its staff and limited its staff’s computer usage. OCR provided the CE with technical assistance on business associates (BAs) and BA agreements, risk analysis and risk management plans, and notification to individuals. OCR obtained assurances that the CE implemented the corrective actions listed above.