May 30, 2020

May 29, 2020

Subscribe to Latest Legal News and Analysis

May 28, 2020

Subscribe to Latest Legal News and Analysis

May 27, 2020

Subscribe to Latest Legal News and Analysis

Business Associate Exposes Protected Health Information of 19,000 Patients

An error made by a transcription service provider during a software upgrade on Orlando Orthopaedic Center (OOC)’s server in December 2017 has resulted in the exposure of more than 19,000 patients’ protected health information (PHI). PHI stored on OOC’s server from December 2017 until February 2018 – when the breach was finally discovered – was freely exposed over the internet without any authentication. Upon full investigation, patients’ names, social security numbers, dates of birth, insurance information, employer details, and treatment types were deemed accessible.

Although it remains unknown whether any PHI was accessed by unauthorized individuals during the two month exposure period, OOC has said the vendor has corrected the issue. OOC has offered credit monitoring and identity theft protection to all patients whose social security numbers were exposed as well as provided ongoing cybersecurity awareness training to its staff.

There was a delay between the discovery of the breach and the breach notification to the Department of Health and Human Services’ Office for Civil Rights (HHS-OCR), the media, and the individual patients, which may carry risks of additional penalty for noncompliance with the Health Insurance Portability and Accountability Act (HIPAA). HIPAA requires notice within 60 days of the discovery of a breach to HHS-OCR, the media, and the affected individuals when PHI of more than 500 individuals is exposed. Although the breach incident appears on HHS-OCR’s Breach Portal, it remains under investigation with the agency.

This incident is another important reminder of the importance of engaging vendors that incorporate strong electronic PHI management in business associate agreements. It is also important to consider including specific breach notification requirements in contracts to ensure timely notification in the event of a breach.

© 2020 Faegre Drinker Biddle & Reath LLP. All Rights Reserved.


About this Author

Sumaya Noush, Drinker Biddle Law Firm, HealthCare Attorney

Sumaya Noush counsels health care clients on strategic and operational matters including transactions, corporate governance, and regulatory compliance. She helps her clients navigate the daily challenges of running their operations while identifying opportunities for growth in today’s rapidly evolving and highly competitive health care market.

Sumaya previously served as a law clerk for Drinker Biddle, an instructor at Yale’s Bioethics Institute where she taught a seminar on FDA law and medical ethics, and a Visiting Scholar at...