Siouxland Anesthesiology, Ltd.

Siouxland Anesthesiology, the covered entity (CE), reported it was the subject of a criminal malware attack. The CE reported that hackers infiltrated one of its computer servers and installed malware that left patients’ electronic protected health information (ePHI) vulnerable to unauthorized access. The exposed ePHI included patients’ names, addresses, dates of birth, and, in some cases, Social Security numbers. The breach affected approximately 13,000 individuals. Following the breach report to the individuals, media and HHS, the CE investigated the incident and provided affected individuals with credit monitoring information and contact information should they have questions regarding the breach. In response to the breach and OCR’s review, the CE took a number of actions to address and mitigate the effects of the breach including: disabling the compromised server and replacing it with a new server; examining all work stations to ensure they were secure; and, establishing user controls and updating its password management procedures. In the course of its review, OCR provided the CE with technical assistance regarding necessary changes to its policies and procedures, and the requirements to conduct periodic thorough enterprise wide risk analyses and to review and update its risk management process.