Walnut Place

The covered entity (CE), Walnut Place, experienced two ransomware attacks on one of its servers containing electronic protected health information (ePHI). The ePHI on the server included patients' names, social security numbers, driver’s license numbers, dates of birth, addresses, telephone numbers, medical record numbers, payment information, insurance information, and clinical information for a combined total of approximately 6,500 individuals for both incidents. The CE reported the second attack as a separate breach. Upon discovering the breach, the CE contained and stopped the attack by removing infected files from the server. The CE provided breach notification to HHS, affected individuals, and the media. The CE improved administrative and technically safeguards and retrained staff on observing and reporting malicious software. OCR obtained assurances that the CE implemented corrective actions to enhance its security controls.