Aurora Health Care

A business associate (BA), American College of Cardiology Foundation, inadvertently disclosed some of the covered entity’s (CE) patient information to one of its vendors without previously executing a BA agreement. The disclosure affecting approximately 869 individuals and the types of protected health information (PHI) included names, dates of birth, social security numbers, and registry identification numbers. The CE, Aurora Health Care, Inc., provided breach notification to HHS, affected individuals and the media. Following the breach, the CE investigated the breach to determine the root cause, halted the demonstration, destroyed the data, suspended access to the environment and reviewed and ensured that the testing environment was free of PHI. Additionally, the CE reviewed controls and access methods for vendors and disabled the “copy and paste” function to prevent copying of data from the registry environment and formalized procedures for transferring data from the live environment. OCR obtained documented assurances that the CE implemented the voluntary corrective actions listed above. OCR also reviewed the CE’s policies and procedures on safeguarding PHI.