On January 25, 2014, Valley View Hospital Association, the covered entity (CE), discovered that malware infected 172 of its computer workstations. The CE determined that, on 90 of the 172 infected workstations, the malware took screen shots of the electronic protected health information (ePHI) belonging to 5,415 individuals, and the malware stored those screen shots as encrypted files “hidden” on the workstations’ hard drives. The screen shots contained names, social security numbers, and other demographic information as well as credit card information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE deployed anti-virus software and cleaned the malware from its systems. OCR’s investigation resulted in the CE revising its procedures for safeguarding ePHI and protecting against malicious software. OCR provided technical assistance to the CE regarding the Security Rule’s risk analysis and risk management requirements. OCR also obtained an assurance from the CE that it would update its risk analysis and risk management plan.
