HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 1, 2018.
- Organization as reported
- Coastal Cape Fear Eye Associates, P.A., NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer, Network Server
- Submission date
- Feb. 1, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13927, row:5066)
- Archived copy
- Held in the private archive (provenance)
On December 5, 2017, the covered entity (CE), Coastal Cape Fear Eye Associates, P.A., discovered that a folder in its shared computer drive was infected with ransomware due to a phishing attack. The types of protected health information (PHI) in the shared drive included patients' names, addresses, dates of birth, phone numbers, Social Security numbers, insurance card information, driver’s license information, Medicare information, email addresses, ethnicities, emergency contacts, medical histories, medications, medical diagrams, and billing and payment histories approximately 925 individuals. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach. Following the breach, the CE installed new hard drives, risk-ware protection updates, and operating system updates, and also restored backups and reset firewall settings. Additionally, the CE retrained its workforce, increased the frequency of trainings, and limited employees’ access to social media websites and non-work related websites. The CE also updated its HIPAA policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above. On April 30, 2019, the CE’s sole practitioner retired and closed his practice.