Biomechanics

A security researcher accessed the covered entity's electronic protected health information (ePHI) due to a vulnerability in a business associate's (BA) data storage system. The researcher reportedly did not intend to use or disclose the information. The breach affected 1,049 individuals and involved in the breach included names, addresses, birthdates, driver's license numbers, social security numbers, and clinical information such as diagnoses, lab results, and medications. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the BA returned the ePHI to the covered entity. The BA was closing its business at the time of the breach and is now out of business. OCR obtained a copy of the CE's BA agreement with this BA. As a result of OCR’s investigation the CE increased its awareness of its responsibilities with respect to its BAs.