On February 27, 2018, the covered entity (CE), Artesia General Hospital, notified OCR of a breach by its business associate (BA), Nuance Communications/Fast Health, that occurred from November 20, 2017, to December 9,2017, when Nuance's computer server was taken offline. The electronic protected health information (ePHI) involved in the breach consisted of approximately 864 patients' names, dates of birth, diagnoses, and other treatment information. OCR opened an investigation of the CE to determine compliance with the Privacy Rule’s BA contract requirements. The CE provided the BA Agreement (BAA) with Nuance and OCR determined that the BAA appears to comply with the requirements specified in the Privacy Rule. OCR opened a separate review of the BA.
