HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 2, 2017.
- Organization as reported
- Bluetail Medical Group, MO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer
- Submission date
- Aug. 2, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14106, row:5245)
- Archived copy
- Held in the private archive (provenance)
On August 1, 2017, the covered entity (CE), Bluetail Medical Group, discovered that ransomware had been installed on a computer server storing 4,026 individuals' x-ray images, names and dates of birth. The ransomware blocked all files with encryption, and the hackers sent an email asking for bitcoin in exchange for the encryption key. Following the breach, the CE immediately removed the malware and recovered the lost data, installed new virus-protection software, and improved safeguards through encryption, server monitoring, and implementing a cloud-based backup for its server. The CE provided breach notification to HHS, affected individuals, and the media. The CE also retrained its staff on security measures. OCR obtained documented assurances that the CE implemented these corrective action steps.