HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Malware Potentially Exposes HIPPA Data at North Carolina Dermatology Clinic

Central Dermatology Center & Carolina Medi-Spa is the latest healthcare institution to experience a HIPAA breach as a result of malware. The malicious software was discovered on one of the central servers of its IT network on Sept 25, 2014 according to a statement issued by the facility.

The notice, released on Friday, explained that as soon as the problem was discovered, an investigation was launched and forensic IT experts were enlisted to determine the nature of the malware and the data that it could have potentially compromised.

The investigation determined that electronic health data had potentially been exposed by the malware, although there was no mention of the number of individuals that were believed to be affected. The data that has been compromised includes Social Security numbers, contact telephone numbers, addresses, dates of birth, age, sex and race information as well as hospital billing and diagnostic codes. The database also includes data such as health insurance policy numbers, provider details, co-payment information, treatment dates, employment details and account balances.

The malware is believed to have been installed on 9th August, 2012 in spite of the server being password protected and having anti-malware software installed. Practice Administrator, Greg Catt, explained in a statement that “Central has improved our security wherever necessary to help protect our community. On behalf of the people of Central Dermatology Center, we sincerely apologize for any inconvenience this may cause.” He went on to say “Taking aggressive action early and confronting this issue is consistent with the practice’s core value of behaving in an ethical and transparent fashion.”

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Following on from the forensic analysis the center implemented further controls to protect the privacy and security of patient data and will offer all individuals affected by the breach free credit monitoring services to mitigate any damage caused. Identify theft protection services are also being offered to those affected.

HIPAA demands that healthcare organizations implement the necessary technical, physical and administrative safeguards to protect patient health data, although even if these controls are in place it does not guarantee protection. In cases such as the exposure at Central Dermatology Center & Carolina Medi-Spa, the OCR of the Department of Health and Human Services conducts an investigation to determine whether all HIPAA regulations have been followed and heavy fines can be issued for any non-compliance issues that are discovered.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.