HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 30, 2018.
- Organization as reported
- Mind and Motion, LLC, GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Nov. 30, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13611, row:4750)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Mind and Motion, discovered that all the files and applications on its server had been corrupted with an encrypted extension. The covered entity immediately started an investigation which found that a malicious key logger and spam email application had been installed on its server. The breach affected approximately 16,000 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, gender, Social Security numbers, medical diagnoses, insurance information, and medical records, The CE notified OCR, affected individuals, placed substitute notices on its website, and notified the media. In response to the breach, the CE reset all passwords, updated it password management policy, encrypted its server and all computers, and provided HIPAA training to all staff members. OCR provided technical guidance to the CE regarding the implementation of a risk management plan. OCR obtained assurances that the CE implemented the corrective actions noted above.