Cove Family and Sports Medicine, LLC

The covered entity (CE), Cove Family and Sports Medicine, discovered that it had been attacked by ransomware on April 14, 2017. The attack potentially affected the CE’s entire electronic medical records system, including names, Social Security numbers, addresses, patient identification numbers, prescription information, diagnoses information, procedure information, and times and dates of treatment for 4,299 individuals. The CE responded to the ransomware by reinstalling its operating system and restoring patient records from a remote, off-site backup. Additionally, the CE changed all passwords, strengthened password requirements, provided additional training to its employees, upgraded its anti-virus protection and monitoring, implemented an additional backup program and protections, and removed internet access from all computers with direct access to its server. The CE provided breach notification to HHS, affected individuals, the media, and on its website. OCR obtained assurances that the CE implemented the corrective actions listed above.