Dr. DeLuca Dr. Marciano & Associates, P.C.

On November 29, 2018, Dr. DeLuca, Dr. Marciano, and Associates, P.C., the covered entity (CE), were subjected to a cyber-attack that affected the electronic protected health information (ePHI) of 23,578 individuals. The PHI was contained on two servers. The CE reported that clinical, demographic, and financial information was affected in this incident. However, later the investigation confirmed that one of the servers had been encrypted and the PHI on that server was not involved. The PHI on the unencrypted server contained only patient names and medical imaging. Following the breach, the CE provided breach notification to the affected individuals and to the media. The CE is taking the following actions to improve its security posture: conducting a risk analysis and implementing a risk management plan, upgrading its firewall and antivirus software, appointing a new Privacy Officer, and providing additional HIPAA training to all of its workforce members. OCR provided technical assistance to the CE regarding conducting a thorough enterprise-wide risk analysis. We also provided guidance on the development and implementation of written policies and procedures as required by the HIPAA Rules.