Pasquotank-Camden Emergency Medical Service

On December 14, 2018, Pasquotank-Camden Emergency Medical Services, the covered entity (CE), discovered that data from its administrative server where protected health information (PHI) was stored, was missing. The breach affected 40,753 individuals whose names, billing records, medical information, Social Security numbers, and dates of birth were stored on the server. The CE’s forensic investigation determined that the breach was caused by a brute force attack to its server by a hacker located in Eastern Europe. The CE restored the deleted data using a recent backup of the server. The CE sent timely media notification on December 21, 2018. Individual notification and substitute notification were not provided until February 21, 2019 and February 25, 2019, respectively. The CE offered affected individuals identity monitoring and restoration insurance for one year following the breach. In response to the breach, the CE implemented physical safeguards for its administrative office, updated software, migrated historical data to external hard drives, initiated a process to identify a new EHR software vendor, and improved safeguards for system user accounts. OCR provided technical assistance regarding how to determine the start date of a breach and obtained assurances that the CE implemented the corrective actions listed above.