Atchison Hospital Association

On February 14, 2018, a business associate (BA), Fast Health Corporation, notified the covered entity (CE), that a third party hacked into to the BA's web server and was able to acquire the CE's protected health information (PHI) from August 14, 2017, to August 18, 2017. The breach affected 667 individuals and included dates of birth, names, photographs, length, weight, sex, and parents' names. To mitigate this breach and prevent a similar one from occurring, the CE terminated its relationship with the involved BA. The CE provided breach notification to HHS, affected individuals, and the media. As a result of OCR’s investigation, the CE updated its Breach Rule Notification policy and trained staff on its updated policy. OCR obtained documented assurances that the CE implemented the corrective action steps listed above.