HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 31, 2015.
- Organization as reported
- Siouxland Anesthesiology, Ltd., SD
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- July 31, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14741, row:5880)
- Archived copy
- Held in the private archive (provenance)
Siouxland Anesthesiology, the covered entity (CE), reported it was the subject of a criminal malware attack. The CE reported that hackers infiltrated one of its computer servers and installed malware that left patients’ electronic protected health information (ePHI) vulnerable to unauthorized access. The exposed ePHI included patients’ names, addresses, dates of birth, and, in some cases, Social Security numbers. The breach affected approximately 13,000 individuals. Following the breach report to the individuals, media and HHS, the CE investigated the incident and provided affected individuals with credit monitoring information and contact information should they have questions regarding the breach. In response to the breach and OCR’s review, the CE took a number of actions to address and mitigate the effects of the breach including: disabling the compromised server and replacing it with a new server; examining all work stations to ensure they were secure; and, establishing user controls and updating its password management procedures. In the course of its review, OCR provided the CE with technical assistance regarding necessary changes to its policies and procedures, and the requirements to conduct periodic thorough enterprise wide risk analyses and to review and update its risk management process.