Center for Orthopaedic Specialists data breach (2018)

Breach window

Feb 1, 2018 → Mar 31, 2018

When the intrusion reportedly occurred, per the linked filings

Breach discovered

Feb 1, 2018

Reported by HHS OCR filing

76 days

CALIFORNIAHHS OCRFirst filinglinked via same-victim cross-source · 100%

Filed Apr 18, 2018bd_2f486e4ca1cf8f57

Center for Orthopaedic Specialists - Providence Medical Institute (PMI) reported to HHS on 2018-04-18 a Hacking/IT Incident affecting 85,000 individuals. Breached information located on Network Server. The breach involved ransomware attacks encrypting ePHI between February and March 2018. A $240,000 civil monetary penalty was imposed by OCR.

Affected (this filing): 85,000

HIPAA 60-day late · 76dHHS notified · 76d

🐻California State AGMost recent

Filed Apr 19, 2018bd_1884c9e76ff496c9

Center for Orthopaedic Specialists (COS) experienced a ransomware attack via a third-party IT vendor between Feb 18 and Mar 4, 2018. Malicious software encrypted patient data including names, DOBs, medical records, and SSNs. COS states no data was removed/exfiltrated. The affected system was taken offline. Federal law enforcement was notified. Patients are offered 24 months of identity theft protection.

Center for Orthopaedic Specialists

Litigation Timing

Sensitive data

Timeline