Alamo Consumer Direct

The business associate (BA), Alamo Consumer Direct, reported that an error in its web portal security settings allowed unauthorized access to protected health information (PHI) between September 20, 2013 and October 17, 2013. The breach affected approximately 520 individuals and included names, program participation status and a program spending summary. The BA provided breach notification to HHS, affected individuals, and the media. Following the breach, the BA corrected the security settings to limit access and trained staff. As a result of OCR's investigation, the BA entered into a new BA agreement with the covered entity, the Texas Department of Aging and Disability Services.