Elizabeth L. Brown, MD, PLLC

The covered entity (CE) reports that her single provider practice was the target of a ransomware attack that affected records in the CE’s billing and scheduling program on or about March 14, 2017, and affected records in its electronic medical record program on or about March 28, 2017. The types of protected health information (PHI) involved in the breach included the names, addresses, dates of birth, medical information, driver's license numbers, social security numbers, and insurance claim information of 8,436 individuals. The CE provided breach notification to HHS, affected individuals, and the media. The CE thoroughly investigated the incident with the assistance of third party experts to ensure that its systems were secure and that it recovered all affected data. The CE took a number of additional measures to safeguard its election PHI, such as using unique credentials for all levels of system access, password protecting all workstations, revising levels of access for staff, and changing its remote access system. The CE began selecting a cloud-based vendor to replace its present system with the intention of migrating all electronic medical records to the new platform. OCR reviewed the CE’s policies and procedures on uses and disclosures of PHI and safeguards, a copy of its risk analysis, and the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed above.