Sunflower Medical Group

The covered entity (CE), Sunflower Medical group, reported that it experienced a cyberattack that compromised the protected health information (PHI) of approximately 220,968 individuals. The PHI involved names, dates of birth, addresses, social security and drivers’ license numbers, claims information, diagnoses/conditions, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE deployed endpoint monitoring, implemented security enhancements, and retrained its workforce to better protect its electronic PHI. OCR provided the CE with technical assistance regarding the HIPAA Rules.