Pediatric Healthcare Solutions, P.C.

An unknown party gained unauthorized access to the covered entity’s (CE) electronic health records system due to a misconfigured security firewall. The computer server contained the electronic protected health information (ePHI) of 6,932 current and former patients of the CE, Pediatric Healthcare Solutions, P.C., a division of ProHEALTH. The breached ePHI included names, dates of birth, medical/insurance information and, in some instances, social security numbers. The CE provided breach notification to HHS, the media, and the affected individuals (and offered one year of credit monitoring services at no cost to the affected individuals), and posted notice to its website. Following the breach, the CE conducted a forensic review, reversed the errant firewall change, and confirmed that there were no other ProHEALTH clinics with overly permissive firewall settings. The CE also decommissioned the affected server, performed a complete rebuild, and implemented a number of network security monitoring changes, including a peer review system relating to any and all firewall changes, and a formalized change management process for certain risk impact and security related changes. As a result of the breach, the CE also sanctioned workforce members in connection with the firewall misconfiguration. OCR obtained assurances that the CE implemented the corrective actions listed above. The CE is expected to complete its implementation of additional types of security event logs, conduct a risk analysis, and implement a corresponding remediation plan.