Health Management Concepts, Inc.

A business Associate (BA), Health Management Concepts, Inc., discovered on July 16, 2018, that ransomware had encrypted data on a secure File Transfer Protocol (sFTP) computer server, including electronic protected health information (ePHI). While the BA determined that the ransomware incident resulted in a low probability of compromise to ePHI and no reportable breach occurred, ePHI for one covered entity (CE), Inlandboatmen’s Union of the Pacific National Benefit Fund, was inadvertently disclosed to the ransom attacker during negotiations for the decryption key. The breached ePHI included the names, Social Security numbers, and health insurance plan information of 2,452 individuals. After technical assistance from OCR, the BA provided breach notification on behalf of the CE. In response to the breach, the BA reset passwords, installed a new computer server with a new IT host, reconfigured firewall and remote access procedures, revised its written breach notification procedures, and engaged a new data backup service. In response to technical assistance from OCR, the BA completed a risk analysis in June 2019 to meet the standards of the Security Rule. OCR obtained assurances that the BA implemented the corrective actions listed above and performed notification obligations on behalf of the CE.