Athens Orthopedic Clinic, P.A.

Athens Orthopedic Clinic PA reported to HHS OCR on 2016-07-29 an Unauthorized Access/Disclosure affecting 201,000 individuals; breached information was located on Electronic Medical Records. A hacker used a vendor's credentials on June 14, 2016 to access the EMR system and exfiltrate PHI—including names, DOBs, SSNs, medical procedures, test results, and health insurance information—continuing until July 16, 2016. The hacker demanded money for return of the stolen data. Athens Orthopedic agreed to a $1.5M HHS OCR settlement and a two-year corrective action plan.

Affected (this filing): 201,000