HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 10, 2016.
- Organization as reported
- Vascular Surgical Associates, GA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Nov. 10, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14367, row:5506)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Vascular Surgical Associates, discovered that on September 13, 2016, it had experienced a distributed denial of services attack. Upon investigation, it was determined that unauthorized third parties were able to gain access into the CE’s computer server through an administrative account set up by its electronic health records (EHR) system vendor and to enter the server and obtain PHI undetected after installing software to prevent the CE from seeing the activity. The types of PHI on the CE’s server included patients' names, addresses, dates of birth, and health diagnoses and conditions. The server contained PHI for approximately 36,496 individuals. The CE provided breach notification to HHS, affected individuals, and the media. In response to the breach, the CE immediately terminated the unauthorized third parties’ access to its server, changed and strengthened passwords and contacted law enforcement. Additionally, the CE strengthened the security of its server by implementing Sonicwall protection, antivirus software, and Secure Sockets Layer virtual private network, and conducting daily log reviews looking for anomalies. Furthermore, the CE rebuilt its network, including its EHR system, retrained its workforce, and strengthened its HIPAA policies and procedures. OCR obtained assurances that the CE implemented the corrective actions listed above.