HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 14, 2023.
- Organization as reported
- Top of the World Ranch Treatment Center, IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- March 14, 2023
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 10862, row:2001)
- Archived copy
- Held in the private archive (provenance)
The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) today announced a settlement of $103,000 in an investigation of Top of the World Ranch Treatment Center (TWRTC), a substance abuse disorder treatment provider, concerning a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule’s Risk Analysis provision. OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules. The Risk Analysis provision of the Security Rule requires a regulated entity to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by that entity. The Breach Notification Rule requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information (PHI). TWRTC detected a phishing attack, in which an unauthorized third party accessed a workforce member’s email account. TWRTC reported to OCR that it engaged a third-party forensic firm to assist with securing the account and investigating the extent of unauthorized activity. That investigation concluded that PHI for 1,980 patients was potentially accessed by the unauthorized party. OCR initiated an investigation of TWRTC’s compliance with the Risk Analysis provision. In response to OCR’s investigation, TWRTC has entered into and agrees to comply with a corrective action plan. OCR recommends that health care providers, health plans, clearinghouses, and business associates that are covered by HIPAA take the following steps to mitigate or prevent cyberthreats: • Identify where ePHI is located in the organization, including how ePHI enters, flows through, and leaves the organization’s information systems. • Integrate risk analysis and risk management into the organization’s business processes. • Ensure that audit controls are in place to record and…