HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of May 15, 2015.
- Organization as reported
- The MetroHealth System, OH
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer
- Submission date
- May 15, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14798, row:5937)
- Archived copy
- Held in the private archive (provenance)
The MetroHealth System, a covered entity (CE), reported that it was the victim of a cyber-attack affecting the protected health information (PHI) of approximately 981 individuals. In addition, MetroHealth discovered that its antivirus protection was disabled by an employee of its business associate (BA) General Electronic Company, when the employee was performing a complex software update. Four files became infected with malware while the antivirus protection was disabled. The PHI involved in these breach incidents included names, dates of service, medications prescribed, and clinical information. The CE notified HHS, affected individuals, and the media. In its mitigation efforts, the CE implemented additional technical and security safeguards to better protect its PHI. OCR obtained assurances that the CE implemented the corrective actions noted.