Man Alive, Inc. and Lane Treatment Center, LLC

The covered entity (CE), Man Alive, Inc. and Lane Treatment Center, reported that on September 8, 2016, through remote access, a cyber-attacker hacked the CE’s computer system and installed ransomware on an employee’s computer to gain unauthorized access into the electronic patient record system. The CE determined that the hacker accessed and downloaded summary patient profiles and lists consisting of 860 patients’ names, birthdates, social security numbers, drug dosage information, insurance identification numbers, street addresses, phone numbers, employment status and some demographic data. The CE immediately removed the infected computer from the network and any data that was subjected to malicious encryption was restored. The CE provided breach notification to HHS, affected individuals, and the media, and also posted substitute notice on its website. It also notified the FBI and vendor partners. Following the breach, the CE disabled all user remote access with the exception of a few vendors and implemented a security appliance that performs virus scanning at the gateway level, blocks unwanted protocols by policy, and provides firewalls. The CE also strengthened the complexity requirements for all user passwords. OCR obtained sufficient assurances that the CE implemented the corrective actions listed above.