HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of June 4, 2019.
- Organization as reported
- Rosenbaum Dental Group, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer
- Submission date
- June 4, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13377, row:4516)
- Archived copy
- Held in the private archive (provenance)
On June 3, 2019, Rosenbaum Dental Group, the covered entity (CE), discovered ransomware on its computer system that encrypted the CE’s electronic medical record system. The breach affected 1,208 individuals’ protected health information (PHI), including patients’ first and last names, dates of birth, chart notes, financial information, insurance information, pharmacy numbers, and the names of other family members who had received services from the CE. The CE provided breach notification to HHS, affected individuals, and the media. The CE investigated and determined that the breach was caused by malware that was activated when an employee clicked on a fraudulent computer pop-up window. In response to the breach, the CE improved its process for saving backups of its computer system, removed internet access from computers located in the patient treatment area, changed malware detection vendors, developed and revised its policies and procedures, and trained staff members on the new policies and procedures. The CE also trained employees identifying malicious computer pop-up windows and phishing emails. OCR obtained assurances that the CE implemented the corrective actions listed above.