HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 15, 2016.
- Organization as reported
- Lee Rice D.O., Medical Corp DBA Lifewellness Institute, CA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Electronic Medical Record
- Submission date
- July 15, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14479, row:5618)
- Archived copy
- Held in the private archive (provenance)
Malware was installed by cyber-intruders into PrognoCIS, the medical records system of the business associate (BA), Bizmatics, Inc. The breach affected approximately 2,473 individuals who were patients of the covered entity (CE), Lee Rice D.O. Medical Corporation d/b/a Lifewellness Institute. The types of protected health information (PHI) involved included full names, addresses, dates of birth, phone numbers, sex, marital status, social security numbers, claims information, diagnoses/conditions, lab results, and medications. The CE provided breach notification to HHS, affected individuals, and the media and also provided substitute notice. In response to the breach, the BA notified and cooperated with the FBI in its investigation. In addition, the BA consulted with an independent cyber-security firm to assess the extent of the breach and to implement additional protective measures to prevent a similar breach from occurring in the future. OCR obtained assurances that the CE and BA implemented the corrective actions noted above.