HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 25, 2019.
- Organization as reported
- Dr. DeLuca Dr. Marciano & Associates, P.C., CT
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer, Electronic Medical Record, Network Server
- Submission date
- Jan. 25, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13557, row:4696)
- Archived copy
- Held in the private archive (provenance)
On November 29, 2018, Dr. DeLuca, Dr. Marciano, and Associates, P.C., the covered entity (CE), were subjected to a cyber-attack that affected the electronic protected health information (ePHI) of 23,578 individuals. The PHI was contained on two servers. The CE reported that clinical, demographic, and financial information was affected in this incident. However, later the investigation confirmed that one of the servers had been encrypted and the PHI on that server was not involved. The PHI on the unencrypted server contained only patient names and medical imaging. Following the breach, the CE provided breach notification to the affected individuals and to the media. The CE is taking the following actions to improve its security posture: conducting a risk analysis and implementing a risk management plan, upgrading its firewall and antivirus software, appointing a new Privacy Officer, and providing additional HIPAA training to all of its workforce members. OCR provided technical assistance to the CE regarding conducting a thorough enterprise-wide risk analysis. We also provided guidance on the development and implementation of written policies and procedures as required by the HIPAA Rules.