Rainbow Children's Clinic

Rainbow Children's Clinic, a healthcare provider in South Carolina, notified the SC Office of Consumer Affairs of a breach involving the theft of patient records. The incident involved the unauthorized access of a laptop containing PHI and PII (names, SSNs, DOBs, addresses, insurance info) of approximately 1,000 individuals. The laptop was stolen from a vehicle, and the clinic offered credit monitoring to affected patients.

Rainbow Children's Clinic (TX) reported to HHS OCR on 2016-10-03 a Hacking/IT Incident affecting 33,698 individuals. On August 3, 2016, a hacker accessed the clinic's network servers and launched a ransomware attack that began encrypting patient data; some patient records were irretrievably deleted. The CE shut down its system immediately, retained a forensic expert, notified HHS/individuals/media, and offered identity protection services. No misuse of personal data was identified. Post-incident, the CE deployed new anti-virus software and implemented staff security-training policies. OCR obtained assurances of corrective action. Breached information was located on Network Server.