Pediatric Healthcare Solutions

An unknown party gained unauthorized access to the covered entity’s (CE) electronic health records system due to a misconfigured security firewall. The computer server contained the electronic protected health information (ePHI) of 6,932 current and former patients of the CE, Pediatric Healthcare Solutions, P.C., a division of ProHEALTH. The breached ePHI included names, dates of birth, medical/insurance information and, in some instances, social security numbers. The CE provided breach notification to HHS, the media, and the affected individuals (and offered one year of credit monitoring services at no cost to the affected individuals), and posted notice to its website. Following the breach, the CE conducted a forensic review, reversed the errant firewall change, and confirmed that there were no other ProHEALTH clinics with overly permissive firewall settings. The CE also decommissioned the affected server, performed a complete rebuild, and implemented a number of network security monitoring changes, including a peer review system relating to any and all firewall changes, and a formalized change management process for certain risk impact and security related changes. As a result o