PVHS-ICM Employee Health and Wellness

PVHS-ICM Employee Health and Wellness, LLC (CO) reported to HHS OCR on 2017-07-03 a ransomware attack (Hacking/IT Incident) affecting 10,143 individuals. Breached ePHI resided on a Network Server and included names, Social Security numbers, addresses, dates of birth, lab results, and diagnoses/conditions. The CE notified HHS, affected individuals, and the media, posted a substitute notice on its website, and offered complimentary credit monitoring. Technical safeguards were strengthened post-breach; OCR provided HIPAA Security Rule technical assistance.

PVHS-ICM Employee Health and Wellness LLC reported a ransomware incident affecting a server at the UCHealth Walk In Clinic in Fort Collins, CO. Discovered May 4, 2017, the server contained PHI and PII (SSNs, names, addresses) for patients seen prior to Sept 2014. No evidence of data exfiltration. 2 NH residents notified. Remediation included taking server offline and encrypted backups.

PVHS-ICM Employee Health and Wellness LLC notified patients of a ransomware incident affecting a server at a former clinic location in Fort Collins, CO. The server contained PHI and SSNs for patients seen prior to Sept 2014. Discovered May 4, 2017. No evidence data was accessed, but notification sent out of caution. Forensic experts engaged; credit monitoring offered.