Rainbow Children's Clinic

On August 3, 2016, a hacker accessed the covered entity's (CE) computer system and subsequently launched a ransomware attack, which began encrypting data stored on the CE's computer servers. The CE immediately shut down its computer system to prevent loss of patient information, and promptly launched an investigation. The CE retained an independent computer forensic expert to assist with the investigation and discovered that some patient records were irretrievably deleted. The CE provided breach notification to HHS, affected individuals, and the media. The CE did not receive any indication that any personal data was misused. However, out of an abundance of caution, the CE offered affected patients identity protection services. Following the breach, the CE installed new anti-virus protection software on all machines operating on its network. It also implemented a policy that specifies staff will be trained on the following topics: how to identify/handle potential scams/hoaxes; how protection software operates; good security practices for web browsing, sharing files, email attachments; risks of installing unsupported software, and; what to do when anti-virus and mal-ware protection software detects a computer virus or worm. OCR obtained assurances that the CE implemented the corrective actions noted above.