G&S Medical Associates, LLC

The covered entity, G&S Medical Associates, LLC(“CE”) reported a breach stating that an unknown individual had encrypted a file on a desktop computer which prohibited the CE from accessing the protected health information (PHI) of at least 400 patients. The initial report estimated the number of patients affected as 3,000, though later the CE filed an addendum reducing the number of affected patients. The health information that was compromised included patient names, dates of service and progress notes. The CE provided breach notification to HHS, updated its safeguards policy and implemented an anti-virus solution. As a result of an investigation, OCR provided technical assistance, and the CE is expected to notify the affected individuals of the impermissible disclosure, document the impermissible disclosure in the affected individuals’ medical record, conduct a risk analysis, implement a risk management plan, and implement a security incident policy and procedure. OCR stated the expectation that the CE will to ensure that all staff are trained on all new policies and procedures and with Security Awareness and Privacy Rule training.