Tampa Bay Surgery Center

The covered entity (CE), Tampa Bay Surgery Center, was notified by the FBI that on May 4, 2017, patient information had been posted online. Based on the CE’s internal investigation, it was determined that a cyber-attacker known as “The Dark Overlord” had compromised remote access to its information system and stole a spreadsheet containing the names, dates of birth, addresses, and social security numbers of 25,848 individuals. The CE provided breach notification to HHS, to affected individuals, to the media and posted notice on its website. In response to the breach, the CE substantially revised its technical security safeguards, including access controls. OCR obtained assurances that the CE implemented the corrective actions listed above.