HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 12, 2017.
- Organization as reported
- Elizabeth L. Brown, MD, PLLC, WV
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- May 12, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14189, row:5328)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE) reports that her single provider practice was the target of a ransomware attack that affected records in the CE’s billing and scheduling program on or about March 14, 2017, and affected records in its electronic medical record program on or about March 28, 2017. The types of protected health information (PHI) involved in the breach included the names, addresses, dates of birth, medical information, driver's license numbers, social security numbers, and insurance claim information of 8,436 individuals. The CE provided breach notification to HHS, affected individuals, and the media. The CE thoroughly investigated the incident with the assistance of third party experts to ensure that its systems were secure and that it recovered all affected data. The CE took a number of additional measures to safeguard its election PHI, such as using unique credentials for all levels of system access, password protecting all workstations, revising levels of access for staff, and changing its remote access system. The CE began selecting a cloud-based vendor to replace its present system with the intention of migrating all electronic medical records to the new platform. OCR reviewed the CE’s policies and procedures on uses and disclosures of PHI and safeguards, a copy of its risk analysis, and the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed above.