HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 6, 2019.
- Organization as reported
- NORTH ATLANTA MEDICAL CLINIC, GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer
- Submission date
- Jan. 6, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13579, row:4718)
- Archived copy
- Held in the private archive (provenance)
On November 8, 2018, the covered entity (CE) discovered that an unauthorized third party encrypted 2,800 patients' electronic health records via a ransomware virus and the third party then attempted to extort the CE. The type of protected health information (PHI) involved in this breach included demographic and claims/billing information, including Social Security numbers. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE strengthened its technical safeguards by installing antivirus solutions and purchasing firewall protection. It also implemented biannual HIPAA security training for its staff and limited its staff’s computer usage. OCR provided the CE with technical assistance on business associates (BAs) and BA agreements, risk analysis and risk management plans, and notification to individuals. OCR obtained assurances that the CE implemented the corrective actions listed above.