HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 7, 2017.
- Organization as reported
- University of Mississippi Medical Center, MS
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Electronic Medical Record, Network Server
- Submission date
- July 7, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14132, row:5271)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), the University of Mississippi Medical Center, discovered that data on a segregated network server had been encrypted by ransomware on May 7, 2017. After an internal investigation, it was determined that the server contained data from a previous electronic medical record which had last been used around May 2016. The breach affected the demographic, clinical, and health insurance information of 7,492 individuals. The CE provided breach notification to HHS, affected individuals, and the media, and on its website. At the time of the breach and investigation, the CE was under a Corrective Action Plan (CAP) with OCR and being monitored by OCR's Pacific Region. The CE took voluntarily corrective action in response to the breach and as required under the CAP, including substantially revising its security policies and the conducing an enterprise-wide risk analysis. At the time of this submission, the CE was working with an internal monitor to ensure compliance with the CAP provisions. OCR obtained assurances that the CE implemented the corrective actions listed above and performed its notification obligations.