HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 28, 2017.
- Organization as reported
- Hackensack Sleep and Pulmonary Center, NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Nov. 28, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13991, row:5130)
- Archived copy
- Held in the private archive (provenance)
A ransomware virus infected the Hackensack Sleep and Pulmonary Center’s computer system that encrypted their electronic medical record files. The attacker demanded a ransom be paid in bitcoins to “unlock” the files. The covered entity (CE) did not pay the ransom and restored its medical records files by using an unaffected off-line backup copy. The electronic protected health information (ePHI) included 16,474 patients’ names, addresses, zip codes, dates of birth, drivers’ license numbers, social security numbers, gender, age, email addresses, lab results, medications, diagnoses and health insurance information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE notified the New Jersey Cyber Unit, adopted encryption technologies, and strengthened password requirements. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to review its risk analysis to ensure it completely and appropriately identifies and assesses specific risks and vulnerabilities, develop and implement a risk management plan that addresses the process for managing and reducing the risks identified in the risk analysis to a reasonable and appropriate level, and perform a technical and non-technical evaluation in response to environmental or operational changes affecting the security of ePHI.