Brandywine Pediatrics, P.A.

A computer virus rendered the covered entity's (CE) computer server inaccessible on October 11, 2016, and an unauthorized third party may have gain unauthorized access via the internet. The server contained demographic and clinical information and the CE states that there is no evidence that information was taken. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, it engaged an outside firm to investigate the activity on the encrypted server, including how the malware was deployed and the potential impact on the CE’s patients. To prevent future incidents of this nature, the CE improved technical safeguards and strengthened password requirements. OCR reviewed a copy of the CE’s policies and procedures on uses and disclosures of PHI and safeguards, the CE’s risk assessment, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.