University of Mississippi Medical Center

University of Mississippi Medical Center (MS) reported to HHS OCR on 2017-07-07 a Hacking/IT Incident affecting 7,492 individuals. On May 7, 2017, ransomware encrypted data on a segregated network server containing records from a legacy electronic medical record system last used ~May 2016. Affected data included demographic, clinical, and health insurance information. The CE was under an active OCR Corrective Action Plan at the time; it revised security policies, conducted an enterprise-wide risk analysis, and fulfilled all notification obligations. Breached info located on Electronic Medical Record and Network Server.

HHS OCR settled with University of Mississippi Medical Center (UMMC) for $2.75M regarding a 2013 breach of ~10,000 patients' ePHI. OCR's investigation revealed that UMMC failed to: implement physical safeguards for all workstations that access ePHI to restrict access to authorized users; assign a unique user name and/or number for identifying and tracking user identity in information systems containing ePHI.

University of Mississippi Medical Center (UMMC) reported to HHS OCR on 2013-03-21 a loss/theft incident affecting 500 individuals per the HHS portal (investigation revealed ~10,000 patients impacted). A password-protected laptop went missing from the MICU, likely stolen by a visitor. OCR also found a UMMC network drive broadly accessible via generic credentials over wireless, exposing ePHI of ~10,000 patients since 2008. UMMC paid a $2,750,000 settlement and adopted a corrective action plan. Breached information located on a Laptop.