HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 5, 2017.
- Organization as reported
- Clinton County Board of Developmental Disabilities, OH
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- May 5, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14193, row:5332)
- Archived copy
- Held in the private archive (provenance)
On May 5, 2017, the covered entity (CE) reported that on March 16, 2017, it discovered that a person accessed its computer server and deployed ransomware, which prevented the CE’s employees from accessing data on its server. The server contained patients’ clinical information, diagnoses, conditions, and other treatment information and affected approximately 1,243 individuals. The CE provided notification to HHS, affected individuals, and the media. It also reported the matter to the Clinton County Ohio Prosecutor’s office and the Clinton County Administrator. To prevent similar breaches from happening in the future, the CE decommissioned the affected server, migrated to a cloud solution, and upgraded its anti-virus software to a managed solution monitored by help desk staff. The CE also updated its policy and procedure regarding passwords, implemented its software restrictions policy, and trained its workforce on its policies and procedures regarding HIPAA and safeguards for PHI. OCR obtained documented assurances that the CE implemented the corrective actions noted above.