HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 23, 2016.
- Organization as reported
- Jennie Stuart Medical Center, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Sept. 23, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14415, row:5554)
- Archived copy
- Held in the private archive (provenance)
Hackers placed ransomware on the covered entity's (CE) computer server. The servers stored protected health information (PH)I—addresses, dates of birth, driver’s license data, names, social security numbers, claims information, credit card and bank account information, medical diagnoses, lab results, medications, and other treatment information—for approximately 1,500 individuals. The data on the servers was encrypted and the hackers placed encryption on top of the CE’s encryption, preventing access by the CE. The hackers demanded a ransom, which the CE paid. After payment of the ransom, the CE re-gained access to the data on the server. The CE hired a third party to perform a forensic investigation, and the CE provided a complete copy of the investigative report to OCR. The CE also provided OCR with a detailed analysis of its risk assessment and its determination that the probability that data was compromised was very low. Out of an abundance of caution, the CE expanded its data security monitoring, updated its security management policies, and provided additional training to staff. OCR obtained assurances that the CE implemented the actions listed above.