HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 8, 2016.
- Organization as reported
- Man Alive, Inc. and Lane Treatment Center, LLC, MD
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer, Electronic Medical Record
- Submission date
- Sept. 8, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14431, row:5570)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Man Alive, Inc. and Lane Treatment Center, reported that on September 8, 2016, through remote access, a cyber-attacker hacked the CE’s computer system and installed ransomware on an employee’s computer to gain unauthorized access into the electronic patient record system. The CE determined that the hacker accessed and downloaded summary patient profiles and lists consisting of 860 patients’ names, birthdates, social security numbers, drug dosage information, insurance identification numbers, street addresses, phone numbers, employment status and some demographic data. The CE immediately removed the infected computer from the network and any data that was subjected to malicious encryption was restored. The CE provided breach notification to HHS, affected individuals, and the media, and also posted substitute notice on its website. It also notified the FBI and vendor partners. Following the breach, the CE disabled all user remote access with the exception of a few vendors and implemented a security appliance that performs virus scanning at the gateway level, blocks unwanted protocols by policy, and provides firewalls. The CE also strengthened the complexity requirements for all user passwords. OCR obtained sufficient assurances that the CE implemented the corrective actions listed above.