State of South Carolina Budget and Control Board Employee Insurance Program (EIP)

A workstation in the covered entity's (CE) finance department was infected with malware that recorded keystrokes and captured screenshots. The CE reported 5,596 individuals as being potentially affected by the malware. The types of PHI involved in the breach included names, addresses, dates of birth, benefits identification numbers, social security numbers, and in some cases, banking information. The CE provided breach notification to affected individuals, HHS, and the media. Following the breach, the CE disconnected the workstation from the network and provided the affected employee with new login credentials, a new hard drive, and additional training. The CE updated its Privacy and Security Rule policies and procedures and initiated mandatory annual supplemental training for all of its employees. The CE improved safeguards by implementing additional network security monitoring programs to actively protect workstation environments and limit the proliferation of malware infections on its network. OCR obtained assurances that the appropriate notifications were made and that the corrective actions listed above were completed.