The covered entity (CE), Roswell Park Comprehensive Cancer Center, reported that its business associate experienced a ransomware attack that affected the electronic protected health information (ePHI) of approximately 149,126 individuals. The ePHI involved included names, addresses, email addresses, dates of birth, diagnoses, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice.
