HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of May 22, 2018.
- Organization as reported
- MSK Group, TN
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- May 22, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13807, row:4946)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), MSK Group PC, discovered on May 7, 2018, that ransomware blocked access to its computer servers which the contained electronic protected health information (ePHI) of 566,236 former and current patients. The ePHI potentially affected included demographic, clinical, and health insurance information. The CE was unable to determine whether ePHI had been copied or transferred outside of the network. The CE timely performed its breach notification obligations. In response to the breach, the CE engaged an information technology firm to continuously monitor its information systems and respond to suspicious activity. The CE also retrained its workforce and implemented substantial technical safeguards, including upgrading firewall protections, reconfiguring servers, and restricting remote access. OCR obtained assurances that the CE implemented the corrective actions listed above and performed its notification obligations.