Barton Oaks Dental Group

The covered entity (CE), Neeley-Nemeth, LLP d/b/a Barton Oaks Dental Group, reported that on March 23, 2017, it was the victim of a hacker who accessed its computer network servers and desktop computer and subsequently launched a ransomware attack. The ransomware attack encrypted protected health information (PHI), affecting 17,090 patients' records, including names, dates of birth, Social Security numbers, and medical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE updated its firewall and antivirus/anti-ransomware software for all servers and other electronic devices and retrained its workforce on HIPAA. OCR obtained assurances that the CE implemented these voluntary corrective actions.