HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 1, 2021.
- Organization as reported
- OSF HealthCare System, IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Oct. 1, 2021
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 11879, row:3018)
- Archived copy
- Held in the private archive (provenance)
The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) today announced a settlement with OSF Healthcare System and its Affiliated Covered Entities (OSF), concerning potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules. OSF is headquartered in Illinois and has providers located in Illinois and Michigan. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules , which set forth the requirements that covered entities (health plans, health care clearinghouses, and most health care providers), and business associates must follow to protect the privacy and security of PHI. The settlement resolves an investigation that OCR initiated after OSF filed a breach report in October 2021. In April of 2021, OSF discovered that its files had been infected with the “Nephilim” variant of ransomware. The PHI of 53,907 individuals was exfiltrated by the threat actor. Affected PHI included driver’s license numbers, diagnosis and treatment information, prescription information, medical record numbers, provider names, dates of services, financial account information, and health insurance information. OCR found that OSF had potentially violated provisions of the Privacy, Security and Breach Notification Rules, including: · Failing to conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the ePHI held by OSF; · Impermissibly disclosing the PHI of 53,907 individuals; · Failing to provide timely breach notification to affected individuals; and · Failing to provide timely breach notification to the Secretary of HHS. Under the terms of the resolution agreement, OSF agreed to implement a corrective action plan that OCR will monitor for two years and paid $552,250 to OCR. Under the corrective action plan, OSF has committed to taking steps to ensure compliance with the HIPAA Rules and protect the security of ePHI, including:…