HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of April 19, 2017.
- Organization as reported
- Valley Women's Health, S.C., IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Electronic Medical Record, Network Server
- Submission date
- April 19, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14213, row:5352)
- Archived copy
- Held in the private archive (provenance)
On February 17, 2017, the covered entity (CE) worked with eClinicalWorks, its electronic health records (EHR) vendor, to resolve data synchronization issues. The following day the CE granted two individuals remote access after receiving telephone calls from individuals purporting to be with eClinicalWorks to continue their work. On February 20, 2017, the CE was unable to access EHR data because the data was encrypted and had been subjected to a ransomware attack. The breach affected approximately 4,903 individuals’ protected health information (PHI), including patients’ names, dates of birth, addresses, social security numbers, diagnoses/conditions, lab results, and medications. The CE provided breach notification to HHS, affected individuals, and the media and also reported the breach to the FBI. To prevent a similar occurrence, the CE implemented new Privacy and Security Rule policies and procedures, trained its workforce on the new policies and procedures, implemented a new information system activity review process, deployed new billing software with cloud-based backup, and implemented new anti-virus software. OCR obtained documented assurances that the CE implemented these corrective action steps.