Ambucor Health Solutions, an unincorporated division of The ScottCare

Ambucor Health Solutions is a business associate (BA) utilized by multiple covered entities (CEs) to provide remote monitoring services for cardiac devices. The BA reported that on March 17, 2016, a rogue employee downloaded thousands of its files containing protected health information (PHI) onto a portable "thumb" drive, while he was under indictment for federal crimes, including felony identity theft in a matter unrelated to the BA. The BA immediately shut off the employee's computer access and conducted a thorough investigation. The former employee was incarcerated and cooperated with federal law enforcement authorities. Eventually, the thumb drives were returned to the BA and a computer forensic firm and data review team identified a total of 53 CEs, which included approximately 53,000 individual patients affected by the breach. The types of PHI affected by the breach varied by patient and may have included patients' first and last names, phone numbers, diagnoses, medications, dates of birth, addresses, testing data and results, medical device information, enrollment dates and physicians' names as well as 650 patients' social security numbers. The BA provided breach notificati