Buddhist Tzu Chi Medical Foundation

Buddhist Tzu Chi Medical Foundation discovered on July 15, 2021, that several computers were operating unusually and portions of its network were inaccessible. The organization took affected servers offline and initiated an investigation. It appears that encrypted servers may have contained protected health information (PHI), including names, dates of birth, diagnosis information, and dental x-rays. The investigation could not determine if the information was accessed or removed. The organization upgraded workstation security software and is migrating to a cloud-based dental x-ray platform.

Buddhist Tzu Chi Medical Foundation reported a data breach to the Montana Attorney General. The breach was reported on 2021-09-13. The breach occurred on 7/15/2021. 2 Montana residents were affected.

Affected (this filing): 2

Buddhist Tzu Chi Medical Foundation (CA) reported to HHS OCR on 2021-09-13 a ransomware attack affecting 18,968 individuals. Breached information was located on a Network Server. PHI involved included names, addresses, dates of birth, and diagnoses. The CE notified HHS, affected individuals, and media, and provided substitute notice. In response, the CE strengthened administrative and technical safeguards and retrained staff. OCR provided technical assistance on HIPAA Privacy and Security Rule compliance.

Affected (this filing): 18,968