Urological Associates of Central Jersey

A ransomware computer virus encrypted a shared folder on the covered entity's (CE) domain server. The affected folder contained documents with the demographic and insurance information of 1,800 individuals. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE decommissioned and replaced two affected workstations and the domain server. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to conduct a risk analysis and implement a corresponding risk management plan and implement policies and procedures to regularly review records of information system activity, authorize access to ePHI, address and document security incidents and and their outcomes, and to establish a contingency plan for responding to incidents that damages systems containing ePHI. The CE is also expected to train all members of its workforce on the revised or newly implemented policies and procedures.