San Andreas Regional Center

The business associate (BA), San Andreas Regional Center, reported that it was the victim of a ransomware attack that compromised the protected health information (PHI) of 57,244 individuals. The PHI involved included names, addresses, dates of birth, telephone numbers, Social Security numbers, drivers’ license numbers, passport numbers, email addresses, health insurance information, photos, diagnoses, and other treatment information. The BA notified HHS, affected individuals, and the media. In response to the breach, the BA revised its HIPAA security procedures, retrained its workforce members, and implemented additional technical safeguards. OCR provided technical assistance to the BA.