Alliance Health Networks

On December 17, 2015, the covered entity (CE), Alliance Health Networks, LLC., discovered that a test database containing protected health information (PHI) was accessible to the public via the Internet. The breach affected approximately 42,372 individuals, and their unsecured PHI included names, addresses, telephone numbers, email addresses, medications, and some clinical information. The CE provided breach notification to affected individuals, the media, and HHS. The CE also mitigated the effects of the breach by immediately securing the database, implementing monitoring of its test databases, performing weekly vulnerability scans of its systems, and updating its policies to ensure that production data is not used in test databases. In resolving the breach, OCR provided the CE with technical assistance regarding necessary changes to its policies and procedures, as well its risk management process.