HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

4000 Michigan Chiropractic Patients Notified of Potential Data Breach

4,082 patients of Complete Chiropractic & Bodywork Therapies (CCBT) of Ann Arbor, MI., have been notified of a potential breach of protected health information after malware was discovered on one of the company’s servers.

The malware was discovered on March 19, 2016., after the server malfunctioned. The malfunctioning of the server triggering CCBT’s security protocols which included isolating the server, blocking Internet access, and changing all workstation and third party passwords. CCBT also installed an additional firewall as an extra precaution.

External forensics experts were brought in to investigate the security incident. Their investigation revealed malware had been installed which scanned the network for passwords and login information and transmitted sensitive data to the hacker(s) command and control server.

The server stored patient data including treatment and billing information, in addition to encrypted medical record data. Encrypted information included patient names, addresses, dates of birth, health and diagnosis information, and Social Security numbers.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The malware had been installed on the server four months to the day before the infection was detected and access was blocked. The forensic analysis did not uncover any evidence to suggest that patient data had actually been exfiltrated, and no reports have been received to suggest that patient data have been used inappropriately. However, CCBT and the forensics company were unable to rule out the possibility that data had been accessed.

All affected patients have now been notified of the potential data breach. A year of identity theft protection services have been offered to patients out of an abundance of caution to prevent financial harm or loss.

CCBT already employed a number of safeguards to prevent unauthorized accessing of data, including encryption, although additional security controls will now be added to further protect patient data. CCBT has also employed a new team of skilled IT professionals with experience in implementing safeguards in line with HIPAA regulations to reduce the risk of further attacks being successful.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.