Sport and Spine Rehab

Sport and Spine Rehabilitation, the covered entity (CE), reported that on June 3, 2017, through remote access, a cyber attacker successfully executed a ransomware attack that encrypted the data stored on its computer servers, potentially affecting 34,000 individuals. The types of protected health information (PHI) that were involved included patients’ names, addresses, dates of birth, social security numbers, and medical information. The CE immediately shut down the computer network and contracted with Lore Systems, Inc. to perform a full security sweep of the server infrastructure and perform a number of corrective actions. Lore Systems, Inc. informed the CE that the attack infected the “cloud” server, at which point files were encrypted on the CE’s virtual office server (VOS) through the mapped network drive. The CE confirmed that all encrypted files were limited to just the data folder on the VOS server. The CE provided breach notification to HHS, affected individuals, and the media. The CE hired Provendatarecovery.com to restore the files to their original locations and ensure the computer server environment was clean. The CE indicated that manual scans across all devices are performed once per week and that all devices are protected by on-access or on-demand scanning. OCR reviewed a copy of the CE’s policies and procedures on uses and disclosures of PHI and safeguards, the CE’s risk analysis, its training program, and the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.