Morton Medical Center, PLLC

In March 2016, the covered entity (CE), Morton Medical Center, reported that a virus encrypted many of its merge documents and held them for ransom, preventing the CE from printing any documents that required merging data. An internal investigation revealed that the ransomware had been introduced into its systems through an “add-on” through the Internet. After paying the ransom, the hacker(s) released the CE's entire electronic protected health information (ePHI). The breach affected the ePHI of approximately 3,000 individuals; however, there were no indications that ePHI was actually uploaded or accessed. If the hackers accessed the ePHI, it would have contained names, addresses, demographic information and, possibly, some diagnostic information. Following the breach, the CE conducted an enterprise-wide analysis of the various risks to its ePHI and developed a risk management plan. The CE then overhauled its entire information technology system, focusing on strengthening its physical, administrative, and technical safeguards. The CE also re-trained its workforce members and implemented a new policy that prohibits Internet access for other than business reasons. OCR provided technical assistance regarding the requirements of the Breach Notification Rule.