LCS Westminster Partnership IV, LLP d/b/a Sagewood

An employee of the covered entity (CE), LCS Westminster Partnership IV, LLP d/b/a Sagewood, opened an email that appeared to be an invoice directed to the CE that was actually a Locky variant ransomware attack. The incident affected approximately 863 individuals. The types of protected health information (PHI) involved in the incident included names, addresses, dates of birth, some social security numbers, claims information, billing codes, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media, and also provided substitute notice. Following the breach, which the employee immediately reported to the CE’s information technology services, the CE contained and eliminated the ransomware threat within an hour and verified that no files were missing following the attack. As a result of this incident, the CE upgraded its anti-virus software to better detect new malware threats, and conducted a risk analysis to assess threats to electronic PHI. As a result of OCR’s investigation, OCR obtained written assurances that the CE will update its policies and procedures to require regular review of information system activity.