HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 27, 2017.
- Organization as reported
- Longs Peak Family Practice, P.C., CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer, Network Server
- Submission date
- Dec. 27, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13955, row:5094)
- Archived copy
- Held in the private archive (provenance)
On November 5, 2017, Longs Peak Family Practice, the covered entity (CE), discovered that a hacker had penetrated its computer network and executed malicious code within the network before the CE could prevent it. Though the malicious code included ransomware that encrypted certain files, the CE used backup files to rebuild and restore its network without paying any ransom. The CE hired a company to perform a forensic investigation, which revealed evidence of unauthorized access to some parts of its computer system on November 5, 9, and 10, 2017, resulting in the breach of 16,238 individuals’ electronic protected health information (PHI). The types of PHI involved included demographic, financial, and clinical information. The CE provided breach notification to affected individuals, the media, and HHS. The CE also mitigated the effects of the breach by providing affected individuals with credit monitoring information and contact information should they have questions regarding the breach. Following the breach, the CE improved technical safeguards by verifying that non-essential router ports were closed, wiping and restoring affected hard drives, scanning computing devices for viruses, building a new cloud-based server environment, replacing its firewall, configuring a virtual private network, and implementing a remote monitoring and management agent/software on the CE’s devices. It also hired a new IT provider, updated its risk analysis and risk management plan, and reviewed and revised policies and procedures. In the course of its review, OCR provided the CE with technical assistance regarding risk analysis and risk management.