D. Andrew Loomis MD, Paula Schulze MD, Tammara Stefanelli MD, Christen Vu DO, Anja Crider MD

OCR investigated several co-located covered entities (D. Andrew Loomis MD, Paula Schulze MD, Tammara Stefanelli MD, Christen Vu DO, and Anja Crider MD) sharing staff, office space, and a common network server in WA. On April 21, 2017, their systems suffered a ransomware attack affecting ePHI—including clinical and demographic information—of approximately 9,000 individuals. Breach submitted to HHS on 2017-05-24. Responding providers conducted a risk assessment, rotated credentials, improved technical security, and deployed server monitoring.