HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 28, 2016.
- Organization as reported
- Maryland Medical Center/Dr. Morrill, MD
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer
- Submission date
- Dec. 28, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14315, row:5454)
- Archived copy
- Held in the private archive (provenance)
On November 3, 2016, a cyber-attacker accessed the covered entity’s (CE) practice computer system to deny access to certain portions of its computer system until a ransom was paid. The CE, Maryland Medical Center, shut down the system and utilized its backup to recover the lost information. The compromised information consisted of correspondence to patients regarding test results utilizing patient names, date of birth, social security number. The documents targeted by the virus affected approximately 10,000 individuals. After the compromise, the CE put the computer system in safe mode, conducted a virus scan, and quarantined and destroyed computer viruses. The CE confirmed that it closed the system network and password protected the Wi-Fi. The CE implemented a procedure requiring pre-approval of all electronic devices connected to its systems and requiring a firewall for remote access to the virtual private network (VPN). The CE sanctioned the employee responsible for the breach and retrained all employees. OCR reviewed the CE’s current risk assessment and obtained assurances that the CE implemented the corrective actions listed.