Bronx Lebanon Hospital Center

A transcription company’s subcontractor misconfigured its server, such that search engines, such as Google, were able to locate the server and index the records on that machine, including names, dates of service, medical record number, dates of birth and types of procedures/diagnoses for patients of the covered entity (CE), Bronx Lebanon Hospital Center. The CE that had retained the transcription company, Professional Transaction Services (PTC), provided breach notification to HHS, affected individuals, and the media. Once the CE learned of the breach, it initiated an investigation and learned that PTC’s subcontractor immediately disabled the server, destroyed the hard drive that stored the PHI, and worked with Google to remove the protected health information (PHI) from the Google caches. The CE also engaged a technical consultant to conduct forensic analyses and work to ensure that affected patients’ records could no longer be found by commonly used internet search engines. The CE also terminated its relationship with PTC and engaged a new transcription company. OCR obtained assurances that the CE implemented the corrective actions listed.