Metro Santurce, Inc. d/b/a Hospital Pavia Santurce and Metro Hato Rey, Inc. d/b/a Hospital Pavia Hato Rey

The covered entities (CEs), Metro Santurce Inc. dba Hospital Pavia Santurce and Metro Hato Rey, Inc. dba Hospital Pavia Hato Rey, reported that both entities experienced a ransomware attack that affected the electronic protected health information (ePHI) of 305,737 individuals. The ePHI involved included names, addresses, dates of births, drivers’ license numbers, claims and financial information, diagnoses, lab results, medications prescribed, and other treatment information. The CEs notified HHS, affected individuals, and the media. In their mitigation efforts, the CEs strengthened their administrative and technical safeguards to better protect ePHI.