The covered entitys (CE) database was hacked and held by an outside malware virus. The computer servers hard driving contained the unencrypted, word protected health information (PHI) of approximately 4,000 individuals. The electronic PHI (ePHI) contained names, addresses, telephone numbers, dates of birth, indemnity identification numbers, and diagnosis codes. Since the malware virus was discovered, the ce confirmed that nothing had been copied or removed from the computer, just locked. The ce destroyed the hard driving so that no further access to the hard drive was possible. The CE provided cut notification to HHS, affected individuals, and posted notice on its website. in addition, the ce retrained workforce members, and instituted a requirement of quarterly employee privacy and surety cognisance training. The ce improved safeguards by changing all passwords. Following OCRs investigation, the CE further improved safeguards by changing anti-virus software, encrypting all information saved to its hard drive, and moving ePHI to a mottle based system. It revised procedures to require weekly computer virus scans and monthly audit reports. It also changed vendors to those that ask HIPAA training. Finally, OCR reviewed the CEs comprehensive peril analysis plan. Location of hacked information: Desktop Computer, Network Server business associate present: no