EyeCare of Bartlesville

The covered entity’s (CE) database was hacked and held by an outside malware virus. The computer server’s hard drive contained the unencrypted, password protected health information (PHI) of approximately 4,000 individuals. The electronic PHI (ePHI) contained names, addresses, telephone numbers, dates of birth, insurance identification numbers, and diagnosis codes. Since the malware virus was discovered, the CE confirmed that nothing had been copied or removed from the computer, just locked. The CE destroyed the hard drive so that no further access to the hard drive was possible. The CE provided breach notification to HHS, affected individuals, and posted notice on its website. In addition, the CE retrained workforce members, and instituted a requirement of quarterly employee privacy and security awareness training. The CE improved safeguards by changing all passwords. Following OCR’s investigation, the CE further improved safeguards by changing anti-virus software, encrypting all information saved to its hard drive, and moving ePHI to a cloud based system. It revised procedures to require weekly computer virus scans and monthly audit reports. It also changed vendors to those that require HIPAA training. Finally, OCR reviewed the CE’s comprehensive risk analysis plan.