You and Your Health Family Care

The covered entity (CE), You and Your Health Family Care, Inc., discovered a ransomware virus accessed its server through an open firewall port on September 11, 2016. The ransomware accessed data that included patient names, addresses, dates of birth, Social Security numbers, and clinical information for 1,456 individuals. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE initiated a comprehensive review of its privacy and security safeguards, secured all open ports in its firewall, reviewed and secured all user accounts and strengthened passwords, and installed additional security software. It developed a plan to implement an audit system and encryption mechanisms, and retrain all staff after it finishes the in-depth review and update of its privacy and security policies. Additionally, it will conduct a risk analysis on an annual basis moving forward. OCR obtained assurances that the CE implemented the corrective actions listed above.