HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 19, 2018.
- Organization as reported
- Family Physicians of Old Town Fairfax PC, VA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- July 19, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13746, row:4885)
- Archived copy
- Held in the private archive (provenance)
On May 19, 2018, the covered entity (CE) experienced a ransomware attack that infected its fax server. The CE removed the fax server from the CE’s office and shut down all workstations. Through counsel, the CE engaged an outside firm to conduct a forensic investigation and found that a malicious actor gained access to the CE’s systems through an open RDP port using an account belonging to one of the practicing physicians. The malicious actor deployed “Paradise” ransomware which is not known to have the capability of deleting or exfiltrating data. Finally, the investigator reported that the malicious access to the CE’s network was limited to deploying the ransomware and accessing certain top level folders, which the CE confirmed did not contain PHI. After a full investigation and risk analysis, the CE concluded that the ransomware attack did not constitute a breach and that there was a low probability of compromised PHI. OCR reviewed a copy of the CE’s risk assessment, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained a copy of the business associate agreement between the forensic investigating firm and the CE and obtained assurances that the CE implemented the corrective actions listed here.