Adult Internal Medicine of North Scottsdale

On July 5, 2017, a third party, identified as an online reporter, contacted the covered entity (CE), Adult Internal Medicine of North Scottsdale, claiming to have received demographic information for ten (10) patients from a computer hacker. While the CE was provided information that only 10 patients’ protected health information (PHI) had been breached, in an abundance of caution, the CE provided breach notification to all 11,778 patients and provided free credit monitoring. It also notified HHS and the media. The breached PHI included patients’ names, addresses, dates of birth, and social security numbers. The CE hired a cybersecurity contractor to provide 24/7 monitoring of its information technology system for unusual activity and implemented appropriate safeguards. OCR provided substantial technical assistance to the CE and obtained assurances that the CE implemented the corrective actions noted above.