HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 17, 2016.
- Organization as reported
- Allergy, Asthma & Immunology of the Rockies, PC, CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- June 17, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14496, row:5635)
- Archived copy
- Held in the private archive (provenance)
On June 17, 2016, Allergy, Asthma & Immunology of the Rockies, P.C., the covered entity (CE), discovered that its computer system was hacked and found evidence of ransomware and unknown accounts on the system. The CE determined that because there was unauthorized access to the system, there was a likelihood that electronic protected health information (ePHI) stored on the system had been compromised by the hackers. The compromised ePHI included the demographic, financial and clinical information of up to 6,851 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE replaced the infected computer hard drive, rebuilt its system, and implemented a virtual private network (VPN) to protect against future incidents. OCR’s investigation resulted in the CE revising its procedures for safeguarding ePHI and protecting against malicious software. The CE also updated its risk analysis and risk management plan based on OCR’s technical assistance regarding the Security Rule’s requirements.