HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 16, 2018.
- Organization as reported
- Jemison Internal Medicine, PC, AL
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Feb. 16, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13919, row:5058)
- Archived copy
- Held in the private archive (provenance)
On December 20, 2017, Jemison Internal Medicine, P.C., the covered entity (CE), discovered that files in its electronic medical records (EMR) were encrypted by ransomware. Through its contracted forensic investigator, Altep, the CE found that there was unauthorized access through its remote desktop protocol (RDP) service and that the protected health information (PHI) for 6,550 individuals was exposed. The exposed PHI included names, addresses, birthdates, driver’s license information, social security numbers, insurance information, and medical information. In response to the breach, the CE reset all system passwords, implemented multifactor authentication for all remote access, and reviewed its HIPAA policies and procedures. As a result of this review and OCR’s technical assistance, the CE implemented new policies and procedures regarding its security and risk management program. The CE provided breach notification to HHS, the affected individuals, and the media, and posted substitute notice on its website. OCR obtained assurances that the CE implemented the corrective actions noted above.