HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 24, 2017.
- Organization as reported
- D. Andrew Loomis MD, Paula Schulze MD,Tammara Stefanelli MD, Christen Vu DO, Anja Crider MD, WA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- May 24, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14183, row:5322)
- Archived copy
- Held in the private archive (provenance)
OCR opened an investigation against several covered entities (CE), D. Andrew Loomis M.D. (AL), Paula Schulze M.D. (PS), Tammara Stefanelli M.D. (TS), Christen Vu D.O. (CV), and Anja Crider M.D. (AC), that shared staff and office space and operated their electronic medical records on a common computer server. On April 21, 2017, the CE's data systems were subjected to a ransomware attack, affecting the electronic protected health information (ePHI) of approximately 9,000 individuals, including clinical and demographic information. PS, TS, and CV stopped practicing in the area and transferred medical records to AL. During the investigation, AL and AC demonstrated to OCR that they performed a breach risk assessment and determined there was a low probability of compromise. They also implemented improvements to the technical security of the facility, changed all workforce members’ credentials, and implemented monitors for its computer server activity.