REEVE-WOODS EYE CENTER

OCR investigated the covered entity (CE), Reeve-Woods Eye Center, after the CE reported a breach of 43,000 individuals’ electronic protected health information (ePHI) regarding malware that infiltrated its electronic network on, or around, August 1 through September 17, 2014. The malware caused, among other things, the system to disclose screenshots and keystrokes outside the CE’s network. The types of ePHI involved in the breach included patients' names, social security numbers, dates of birth, addresses, telephone numbers, dates of service, insurance information, diagnosis codes, treatment information, and medical histories. The CE informed and cooperated with the FBI regarding the incident. In response to OCR’s contact in this matter, the CE ensured the proper breach notifications were provided, cleared the system of the malware, and took steps to increase its safeguards and technical security measures.