Southwest Washington Regional Surgery Center

The covered entity (CE) reported to OCR that it was the victim of a malware/phishing attack, affecting the protected health information (PHI) of 2,393 individuals. The types of PHI involved in the breach included names, driver’s license information, social security numbers, claims information, credit card information and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. OCR obtained evidence of the CE’s risk analysis and safeguards implemented prior to the breach. Following the breach, the CE strengthened its administrative and technical safeguards, including implementing multi-factor authentication for its email account.