ABCD Pediatrics, P.A.

ABCD Pediatrics, P.A., the covered entity (CE) reported that its electronic health records system was hacked and ransomware began encrypting protected health information (PHI) stored on its servers. The PHI included patient names, addresses, dates of birth, Social Security numbers, drivers’ license information, diagnoses, medical conditions, lab results, medications, other treatments, and claims information. Approximately 55,447 individuals were affected by the breach. The CE took several corrective action steps to resolve the issue raised in the breach report. The corrective action taken included closing down remote access to terminal services and requiring workforce members to use a Virtual Private Network for remote access. The CE also conducted audits and disabled inactive user accounts, strengthened password requirements, and implemented account lockout policies. During the investigation, OCR verified that the CE implemented encryption on laptops and mobile devices. OCR provided technical assistance concerning the breach notification policies of the CE and received revised versions of those policies. The CE also revised policies regarding periodic risk analyses to update its Security Rule requirements in accordance with OCR’s technical assistance.