New Jersey Spine Center

The covered entity’s (CE) computer system was attacked by a ransomware virus that encrypted files, including the electronic protected health information (ePHI) of approximately 28,000 patients and damaged the network operating system rendering all of the CE's files unusable. The ePHI included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and provided free credit monitoring to affected individuals. Following the breach, the CE deactivated the username and password that the hacker used to break into its system. The CE provided OCR with copies of its HIPAA policies and procedures and assurances that staff was trained on the HIPAA Privacy and Security Rules. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to conduct a risk analysis and implement a corresponding remediation plan, review its existing HIPAA policies and procedures, execute a new business associate agreement with its electronic health records vendor, and conduct an assessment on applications to determine how important each is to patient care or business needs, in order to prioritize for data backup, disaster recovery and/or emergency operations plans.