LCS Westminster Partnership IV, LLP

LCS Westminster Partnership IV, LLP d/b/a Sagewood (AZ) reported to HHS OCR on 2016-11-22 a Hacking/IT Incident affecting 863 individuals. An employee opened a phishing email disguised as an invoice, triggering a Locky variant ransomware attack that encrypted files across email, laptop, and network server systems. PHI involved included names, addresses, dates of birth, some SSNs, claims/billing, and clinical data. The CE contained the threat within one hour, verified no data was missing, upgraded anti-virus software, and conducted a risk analysis. OCR obtained written assurances requiring regular review of information system activity.

Affected (this filing): 863