Hackensack Sleep and Pulmonary Center

A ransomware virus infected the Hackensack Sleep and Pulmonary Center’s computer system that encrypted their electronic medical record files. The attacker demanded a ransom be paid in bitcoins to “unlock” the files. The covered entity (CE) did not pay the ransom and restored its medical records files by using an unaffected off-line backup copy. The electronic protected health information (ePHI) included 16,474 patients’ names, addresses, zip codes, dates of birth, drivers’ license numbers, social security numbers, gender, age, email addresses, lab results, medications, diagnoses and health insurance information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE notified the New Jersey Cyber Unit, adopted encryption technologies, and strengthened password requirements. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to review its risk analysis to ensure it completely and appropriately identifies and assesses specific risks and vulnerabilities, develop and implement a risk management plan that addresses the process for managing and reducing the risks identified in the risk analysis to a reasonable and appropriate level, and perform a technical and non-technical evaluation in response to environmental or operational changes affecting the security of ePHI.