American Family Care, Inc., the covered entity (CE), discovered that its software impermissibly disclosed the electronic protected health information (ePHI) of patients who received services at the clinic. The breach occurred from August 8, 2015 until June 14, 2016 and affected 7,200 individuals. The PHI involved in this breach included names, dates of birth, addresses, internal patient identification numbers, gender, and body parts being x-rayed. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notification on its website. In response to the breach, the CE worked with its software vendor to modify the software to prevent users from including a copy of the entire database with any electronic patient files in the future. The CE also revised its policies, trained its staff on the new policies, and sanctioned an employee for failure to timely update the software licenses. OCR obtained assurances that the CE implemented the corrective actions listed above.
