HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 19, 2018.
- Organization as reported
- Family Healthcare of Lake Norman, NC
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- June 19, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13778, row:4917)
- Archived copy
- Held in the private archive (provenance)
On April 20, 2018, the covered entity (CE), Family Healthcare of Lake Norman, discovered a cyber-attack as the malware was in the process of encrypting information in the CE’s computer system. The CE initially reported that approximately 500 individuals were affected, but after a third party completed a forensic investigation, the CE concluded that there was a low probability of compromise to any PHI. Though the cyber-attack affected the CE’s computer system, the CE’s ePHI was encrypted and password protected. Because the CE determined there was no reportable breach of PHI, and no affected individuals, it did not provide individual notification. Its investigation revealed that the cyber-attack’s likely entry point was via remote desktop connection. To prevent this type of attack in the future, the CE disabled remote access to its computer system. It also converted to a cloud-based practice management and electronic health records software. OCR obtained assurances that the CE implemented the corrective actions listed above.