HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 9, 2017.
- Organization as reported
- Primary Care Specialists, Inc., TN
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- March 9, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14247, row:5386)
- Archived copy
- Held in the private archive (provenance)
On February 27, 2017, the covered entity (CE), Primary Care Specialists, Inc., experienced a cyber-attack in which an unauthorized user accessed the CE’s system by hacking a user account that had been granted administrative privileges. The CE initially reported that approximately 65,000 individuals were affected and the protected health information (PHI) involved included names, addresses, dates of birth, drivers’ license numbers, social security numbers, claims information, diagnoses, lab results, and medications. However, after completing its investigation into the incident, which included a forensic analysis and the assistance of a third party IT service partner, the CE concluded that there was a low probability of compromise to any PHI. The CE provided OCR with documentation of its investigation and conclusion. To prevent a similar type of attack in the future, the CE reset all passwords, implemented new password requirements, reviewed and restructured domain administrator groups, disabled all external remote desktop access, retired the computer server from which the attacker gained access to the CE’s system and deployed additional malware protections. The CE also instituted quarterly security reviews and revised its annual HIPAA training program. Additionally, though the CE ultimately determined there was no reportable breach, it provided individual notification of the incident to its current patients, HHS, the media, and on its website. OCR obtained assurances that the CE implemented the corrective actions listed above.