HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 27, 2019.
- Organization as reported
- Northeast Philadelphia Vascular Surgeons, P.C., PA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- March 27, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13487, row:4626)
- Archived copy
- Held in the private archive (provenance)
Northeast Philadelphia Vascular Surgeons, the covered entity (CE), reported that on March 27, 2019, an unauthorized party gained access to the protected health information (PHI) stored on its server and deployed a ransomware attack that encrypted some files. A third party investigation found a remote desktop login with an IP address originating from Russia. The attack affected 8,193 individuals. After investigation, the evidence did not find any actual opening of the files or exposure of PHI. The CE implemented multi-factor authentication for any remote access into its online environment, a mandatory virtual private network, and location restrictions for remote access. Northeast Philadelphia Vascular Surgeons also provided notification of the breach to all affected individuals. During its investigation, OCR reviewed the newly implemented policies and procedures on uses and disclosures of PHI and the safeguarding of sensitive data. In addition, OCR provided technical guidance leading to the option of a risk analysis. The CE will conduct regular enterprise-wide risk assessments to address the risks and vulnerabilities identified in the risk analysis. OCR obtained assurances that the CE implemented the corrective actions noted.