Rainbow Children's Clinic

Rainbow Children's Clinic, a pediatric clinic in Texas, disclosed a ransomware attack on August 3, 2016. A hacker accessed the system, encrypted data, and irretrievably deleted some patient records. Impacted data included names, addresses, DOBs, SSNs, and medical/payment info for patients and guarantors. The clinic shut down systems, hired forensic experts, and provided 12 months of Equifax credit monitoring. Notification letters were sent in September 2016.

Rainbow Children's Clinic (TX) reported to HHS OCR on 2016-10-03 a Hacking/IT Incident affecting 33,698 individuals. On August 3, 2016, a hacker accessed the clinic's network servers and launched a ransomware attack that began encrypting patient data; some patient records were irretrievably deleted. The CE shut down its system immediately, retained a forensic expert, notified HHS/individuals/media, and offered identity protection services. No misuse of personal data was identified. Post-incident, the CE deployed new anti-virus software and implemented staff security-training policies. OCR obtained assurances of corrective action. Breached information was located on Network Server.