Barton Oaks Dental Group

The covered entity (CE), Neeley-Nemeth, LLP d/b/a Barton Oaks Dental Group, reported that on March 23, 2017, it was the victim of a hacker who accessed its computer network servers and desktop computer and subsequently launched a ransomware attack. The ransomware attack encrypted protected health information (PHI), affecting 17,090 patients' records, including names, dates of birth, Social Security numbers, and medical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE updated its firewall and antivirus/anti-ransomware software for all servers and other electronic devices and retrained its workforce on HIPAA. OCR obtained assurances that the CE implemented these voluntary corrective actions.

Barton Oaks Dental Group notified patients of a ransomware attack on March 23, 2017, which encrypted servers and PCs. The incident potentially exposed patient names, addresses, DOBs, SSNs, and medical information. The company engaged the FBI and a cybersecurity firm, implemented security recommendations, and offered one year of Equifax credit monitoring to affected individuals.