A physician of the covered entity (CE), Baptist Health, stored patients’ protected health information (PHI) on a cloud-based file sharing application without a business associate (BA) contract in place. The PHI potentially affected included the names, dates of birth, and treatment information of approximately 3,453 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE improved safeguards, updated its policies and procedures, and trained users of its electronic health record system on better practices to protect PHI. OCR obtained assurances that the CE implemented the corrective actions listed.
