Harrisburg Gastroenterology Ltd

Harrisburg Gastroenterology LTD., the covered entity (CE) reported that as a result of a ransomware attack, and subsequent investigation, the CE discovered that an unauthorized party had obtained the credentials allowing access to the CE’s record systems The breach affected 93,323 individuals and the types of protected health information (PHI) included demographic and clinical information, health insurance information, and social security numbers. With the assistance of a forensic business associate (BA), the CE deactivated the compromised domain account and reset all account passwords. The forensic information technology (IT) consulting firm conducted a comprehensive assessment to identify risks and vulnerabilities and to provide assistance with the implementation of new technical safeguards. The CE contracted with a new IT consulting firm, replaced its existing computer network firewall with one providing enhanced monitoring and intrusion detection/prevention capabilities and created an additional layer of computer server security. The CE also reviewed all user accounts and limited permissions on certain accounts to restrict standard users from making unapproved changes or installing unauthorized software on their devices. OCR reviewed the CE’s policies and procedures on uses and disclosures of PHI and safeguards. During the investigation, OCR reviewed a copy of the 2016 risk analysis in place at the time of the incident, and the CE’s finalized 2017 risk analysis, the BA agreement with the vendor, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed above.