Rosenbaum Dental Group

On June 3, 2019, Rosenbaum Dental Group, the covered entity (CE), discovered ransomware on its computer system that encrypted the CE’s electronic medical record system. The breach affected 1,208 individuals’ protected health information (PHI), including patients’ first and last names, dates of birth, chart notes, financial information, insurance information, pharmacy numbers, and the names of other family members who had received services from the CE. The CE provided breach notification to HHS, affected individuals, and the media. The CE investigated and determined that the breach was caused by malware that was activated when an employee clicked on a fraudulent computer pop-up window. In response to the breach, the CE improved its process for saving backups of its computer system, removed internet access from computers located in the patient treatment area, changed malware detection vendors, developed and revised its policies and procedures, and trained staff members on the new policies and procedures. The CE also trained employees identifying malicious computer pop-up windows and phishing emails. OCR obtained assurances that the CE implemented the corrective actions listed above.