HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 29, 2016.
- Organization as reported
- San Juan Oncology Associates, NM
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Sept. 29, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14408, row:5547)
- Archived copy
- Held in the private archive (provenance)
On September 29, 2016, San Juan Oncology Associates, the covered entity (CE), reported that it discovered the “Guardware@india” virus on its server. The breach affected the electronic protected health information (ePHI) of 11,383 individuals. The types of ePHI involved in the breach included demographic, financial and, clinical information. Following the breach, the CE installed a new computer server and antivirus software, completed a post risk analysis, and revised its breach notice policy to include all the elements of the media notice requirements. OCR obtained documentation of the CE’s implementation of security controls that will be continuously updated to demonstrate a culture of security compliance. OCR also provided technical assistance on breach notification and security risk analysis requirements.