HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 1, 2017.
- Organization as reported
- State of Alaska Department of Health and Social Services, AK
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer
- Submission date
- Sept. 1, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14074, row:5213)
- Archived copy
- Held in the private archive (provenance)
On September 1, 2017 the covered entity (CE), Alaska Department of Health and Social Services, reported that a Trojan computer virus infected two desktop computers belonging to the CE’s Office of Children’s Services (OCS) in St. Mary’s. The malware incident was caused by an employee who allowed a family member to use the desktop computer to gain access to gaming websites. The CE estimated that the breach may have affected the demographic, clinical, and financial information of more than 500 individuals, however, it is not yet known if any protected health information (PHI) was accessed due to the breach. The CE provided breach notification to HHS, the media, and affected individuals and also posted substitute notice on its website. Following the breach, the CE implemented a layered hardware and software solution to limit external excess to its computer network, system, applications, and data. It also revised policies and procedures, sanctioned the responsible employee, and retrained its workforce. OCR reviewed the CE’s HIPAA Notice of Privacy Practices Policy and obtained assurances that the CE implemented the corrective actions listed above.