BUFFALO HEART GROUP

The covered entity (CE), Buffalo Heart Group reported a breach when a staff physician provided her password to a third party, who then remotely accessed the covered entity’s electronic medical record (EMR). The breach resulted in the disclosure of 567 individuals’ electronic protected health information (ePHI). The ePHI included names, dates of birth, addresses, demographic and clinical information. The CE provided breach notification to HHS, affected individuals and the media. OCR conducted an investigation, which resulted in substantial technical assistance. The CE is expected to conduct a risk analysis that addresses all potential risk and vulnerabilities in the entire operation and corresponding risk mitigation activities, establish a risk management plan, implement a security awareness and training program to include on-going training, implement audit controls, and conduct regular information system activity reviews.