Christine D. Collins, APC & Ann Hofstadter, MD Inc.

The covered entity (CE), Christine D. Collins, APC & Ann Hofstader, MD Inc., discovered that a third party may have gained unauthorized access to its computer systems when email access credentials belonging to an employee were wrongfully acquired as a result of a cyber-security attack on May 27, 2017. The CE’s investigation determined that the employee’s email account was subject to unauthorized access between May 27, 2017, and May 28, 2017. The breach involved the protected health information (PHI) of 1,500 individuals and included names, addresses, dates of birth, social security numbers, and medical information. In response to the breach incident the CE immediately disabled the account, reset the credentials for the impacted user account, implemented two-factor authentication for email access, and updated its policies and procedures. The CE provided breach notification to HHS, affected individuals, and the media. OCR provided technical assistance regarding the CE’s obligation to conduct a comprehensive and current security risk analysis, along with implementing a corresponding risk management/mitigation plan to address the findings of its risk analysis report.