Prosthetic & Orthotic Care, Inc.

Prosthetic and Orthotics Care Inc. was hacked and PHI was either erased or encrypted with ransomware. The covered entity received a ransom note demanding $75,000 in bitcoins. This incident affected 23,015 individuals. Patient information included demographic information, names, and addresses, dates of birth, social security numbers, diagnosis/conditions, and treatment and claims information. Following the breach, the covered entity notified individuals, media, and the Department of Health and Human Services. The covered entity conducted an investigation to determine the root cause of the breach; contacted the FBI; and shut down the entire records system including MedFlex. Following these measures, the covered entity established stringent computer security guidelines, and retrained its staff in the new requirements intended to prevent a similar event from occurring in the future. The covered entity then cleaned and backed up pre-infiltration data files, installed new versions of Exchange Server and Office Suite, and installed a new MedFlex server. The covered entity also initiated upgrades to password length/complexity requirements, initiated multi-factor authentication for external RDP connections to the MedFlex server, and added additional controls on enhanced user privileges. During OCR’s investigation, the covered entity submitted documentation of these voluntary compliance actions. The covered entity also provided OCR with its policies and procedures related to the safeguarding of PHI.