HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 22, 2016.
- Organization as reported
- LCS Westminster Partnership IV, LLP d/b/a Sagewood, AZ
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Email, Laptop, Network Server
- Submission date
- Nov. 22, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14352, row:5491)
- Archived copy
- Held in the private archive (provenance)
An employee of the covered entity (CE), LCS Westminster Partnership IV, LLP d/b/a Sagewood, opened an email that appeared to be an invoice directed to the CE that was actually a Locky variant ransomware attack. The incident affected approximately 863 individuals. The types of protected health information (PHI) involved in the incident included names, addresses, dates of birth, some social security numbers, claims information, billing codes, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media, and also provided substitute notice. Following the breach, which the employee immediately reported to the CE’s information technology services, the CE contained and eliminated the ransomware threat within an hour and verified that no files were missing following the attack. As a result of this incident, the CE upgraded its anti-virus software to better detect new malware threats, and conducted a risk analysis to assess threats to electronic PHI. As a result of OCR’s investigation, OCR obtained written assurances that the CE will update its policies and procedures to require regular review of information system activity.