Atique Orthodontics

On February 29, 2016, the covered entity (CE), Atique Orthodontics, reported that files on its web server were compromised by a potential unauthorized access through one of its computers. The files on the server contained the names, dates of birth, addresses, phone numbers, credit card numbers, insurance information, and social security numbers of approximately 1,506 individuals. The CE provided breach notification to HHS and affected individuals and offered identity theft protection services. Following the breach, the CE disconnected the computer from the network server, reconfigured it, and disabled the remote desktop connection. The CE also implemented access controls, upgraded its firewall and anti-virus and other anti-malware protection software, and encrypted its electronic protected health information (ePHI). Additionally, the CE developed a plan to perform periodic system audits, adopted policies and procedures to ensure that ePHI is not stored on laptops, desktops, or other mobile device, and updated its log-off policy for unattended computers. The CE also inventoried hardware and software which is stored off site and updated workforce members' training with the new policies and procedures. OCR obtained assurances from the CE that it implemented the corrective actions listed above.