Reeve-Woods Eye Center

Reeve-Woods Eye Center (CA) reported to HHS OCR on 2014-11-15 a malware incident affecting 30,000 individuals (the web description references 43,000). Malware infiltrated the CE's electronic network approximately August 1 – September 17, 2014, causing screenshots and keystrokes to be exfiltrated outside the network. ePHI exposed included names, SSNs, dates of birth, addresses, phone numbers, dates of service, insurance information, diagnosis codes, treatment information, and medical histories. The CE cooperated with the FBI, cleared the malware, and strengthened technical security controls. Breached information located on Network Server.

Reeve-Woods Eye Center discovered malware on its servers on September 17, 2014, which had been capturing screenshots containing patients' protected health information, including SSNs and medical history, since approximately August 2014. The malware was removed, and law enforcement was notified. The investigation was ongoing at the time of the November 12, 2014 notification.