Valley Women's Health, S.C.

On February 17, 2017, the covered entity (CE) worked with eClinicalWorks, its electronic health records (EHR) vendor, to resolve data synchronization issues. The following day the CE granted two individuals remote access after receiving telephone calls from individuals purporting to be with eClinicalWorks to continue their work. On February 20, 2017, the CE was unable to access EHR data because the data was encrypted and had been subjected to a ransomware attack. The breach affected approximately 4,903 individuals’ protected health information (PHI), including patients’ names, dates of birth, addresses, social security numbers, diagnoses/conditions, lab results, and medications. The CE provided breach notification to HHS, affected individuals, and the media and also reported the breach to the FBI. To prevent a similar occurrence, the CE implemented new Privacy and Security Rule policies and procedures, trained its workforce on the new policies and procedures, implemented a new information system activity review process, deployed new billing software with cloud-based backup, and implemented new anti-virus software. OCR obtained documented assurances that the CE implemented these corrective action steps.