Tillamook Chiropractic

Tillamook Chiropractic, P.C., the covered entity (CE), reported a breach of protected health information (PHI) affecting 4,063 patients in a malware security incident. Its information technology vendor discovered that malware had been installed on its billing system. The PHI involved included names, addresses, dates of birth, drivers’ license numbers, social security numbers, claims information, clinical information, financial information, diagnoses, lab results, medications, and other treatment information. The CE confirmed the malware was removed. It rebuilt its server with a new operating system, encrypted its hard drives, installed antivirus software, adopted additional privacy and security policies and procedures, and retrained its staff. The CE also provided breach notifications to affected individuals and the media. OCR provided the CE with technical assistance regarding risk analysis, risk management, and the requirements of business associate agreements. OCR obtained assurances that the CE implemented the corrective actions noted.