HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 23, 2016.
- Organization as reported
- Brandywine Pediatrics, P.A., DE
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Dec. 23, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14317, row:5456)
- Archived copy
- Held in the private archive (provenance)
A computer virus rendered the covered entity's (CE) computer server inaccessible on October 11, 2016, and an unauthorized third party may have gain unauthorized access via the internet. The server contained demographic and clinical information and the CE states that there is no evidence that information was taken. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, it engaged an outside firm to investigate the activity on the encrypted server, including how the malware was deployed and the potential impact on the CE’s patients. To prevent future incidents of this nature, the CE improved technical safeguards and strengthened password requirements. OCR reviewed a copy of the CE’s policies and procedures on uses and disclosures of PHI and safeguards, the CE’s risk assessment, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.