Cleveland Medical Associates, PLLC

Cleveland Medical Associates, PLLC, the covered entity (CE), reported that on April 20, 2017, it suffered a malware attack on its computer network in which the attackers requested a ransom in exchange for allowing the CE to regain access to its patient data. The paid the ransom after it was unable to restore its data. The types of compromised protected health information (PHI) included the names, addresses, dates of birth, driver’s license numbers, Social Security numbers, diagnoses, and treatment information of 22,000 individuals. Following the breach, the CE disconnected the affected server to prevent further access, hired a forensic security expert, and migrated its electronic medical records to a cloud-based system to continue operations. As a result of OCR’s investigation, the CE performed a new risk analysis, created an updated risk management plan, updated its policies and procedures, and trained its staff. OCR obtained evidence that the CE provided breach notification to affected individuals and the media. OCR obtained assurances that CMA implemented the corrective actions listed above.