HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 30, 2018.
- Organization as reported
- Family Tree Relief Nursery, OR
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 30, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13708, row:4847)
- Archived copy
- Held in the private archive (provenance)
A brute force ransomware attack encrypted all files on the Family Tree Relief Nursery’s (FTRN’s) computer server. The breach affected approximately 2,000 individuals who received services from FTRN as a business associate (BA) on behalf of covered entities (CE). The types of protected health information (PHI) involved in the incident included names, dates of birth, and health insurance ID numbers. The BA provided breach notification to HHS, CEs, affected individuals, and the media, and also provided substitute notice. Upon discovery of the breach, the BA immediately deleted the encrypted files, restored missing files from backups, thereby ensuring there was no loss of PHI, and worked with its IT provider to eliminate the virus within hours of discovery. In response to the breach, the BA implemented encryption technology, improved the security of electronic PHI, revised policies and procedures, and configured an automatic script that bans internet addresses after failed attempts to log in to its server. OCR provided technical assistance to the BA regarding its security management process.