Medical Information Management Systems, LLC

A business associate (BA), Medical Information Management Systems, LLC (MIMS), a Sheridan Healthcorp, Inc. subsidiary, was part of the electronic network at Valley Anesthesiology and Pain Consultants (VAPC), which suffered a cyberattack when a third party may have gained unauthorized access to the network, including the BA’s computer server(s) on March 30, 2016. VAPC discovered the incident on June 13, 2016, and identified the MIMS server that may have been compromised on July 22, 2016. MIMS was a BA of First Assistant Associates (FAA) at the time, providing billing and collection services. The incident compromised not only electronic protected health information (ePHI) at VAPC, but also ePHI regarding 11,707 individuals in the MIMS server who were FAA patients. OCR opened a separate review of the VAPC breach. The types of ePHI that were potentially accessed in the MIMS server included patient names, dates of birth, addresses, health insurance information, clinical information, and some social security numbers. In response to the breach, MIMS/VAPC installed a virtual privacy network (VPN) device to improve the security of remote access to the network and disabled the compromised network accounts. MIMS/VAPC “blacklisted” the internet addresses identified in the incident to block any additional attempts from those actors to access the electronic health record program (EHR) through the remote desktop protocol. After the breach, MIMS/VAPC rebuilt the compromised server, implemented centralized logging for key systems, whitelisted service provider internet addresses, and switched their antivirus and EHR programs. The BA provided breach notification to FAA as well as to HHS, affected individuals, and the media; however, notice to HHS was not timely. OCR provided technical assistance regarding the BA’s obligations to conduct a comprehensive and current security risk analysis and implement a corresponding risk management/mitigation plan to address any findings.