USC Keck and Norris Hospitals

On August 1, 2016, after being notified that certain files were inaccessible, the covered entity (CE) detected ransomware which had encrypted files on two of its computer servers. The servers stored hospital operational manuals as well records containing the electronic protected health information (ePHI) of potentially 16,000 individuals. The types of ePHI involved in the breach included names, demographic information, dates of birth, treatment information, diagnoses, and in some cases social security numbers. The CE provided breach notification to HHS, affected individuals, and the media. The CE quickly identified the malware and shut down the impacted servers. The CE fully restored the data on the encrypted files through back up data without paying ransom. The CE implemented additional technical measures to improve malware prevention and detection. OCR’s investigation resulted in the CE improving its safeguards. OCR obtained assurances that the CE implemented the corrective actions noted above.