HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 26, 2017.
- Organization as reported
- ABCD Pediatrics, P.A., TX
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- March 26, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14230, row:5369)
- Archived copy
- Held in the private archive (provenance)
ABCD Pediatrics, P.A., the covered entity (CE) reported that its electronic health records system was hacked and ransomware began encrypting protected health information (PHI) stored on its servers. The PHI included patient names, addresses, dates of birth, Social Security numbers, drivers’ license information, diagnoses, medical conditions, lab results, medications, other treatments, and claims information. Approximately 55,447 individuals were affected by the breach. The CE took several corrective action steps to resolve the issue raised in the breach report. The corrective action taken included closing down remote access to terminal services and requiring workforce members to use a Virtual Private Network for remote access. The CE also conducted audits and disabled inactive user accounts, strengthened password requirements, and implemented account lockout policies. During the investigation, OCR verified that the CE implemented encryption on laptops and mobile devices. OCR provided technical assistance concerning the breach notification policies of the CE and received revised versions of those policies. The CE also revised policies regarding periodic risk analyses to update its Security Rule requirements in accordance with OCR’s technical assistance.