The covered entity (CE), Burrell Behavioral Health (BBH), reported that its business associate (BA) had not properly secured a web portal containing medical records. This breach affected 67,493 individuals. The protected health information (PHI) involved included names, addresses, dates of birth, social security numbers, clinical information, diagnoses/conditions, lab results, and medication information. The CE immediately contacted its BA to remove access to its unsecured portal and initiated an investigation to determine the scope of the incident. The investigation revealed that links inside the portal led to a folder hosted by another entity (a contractor to the BA). The system was not configured to require authentication or enable auditing. The CE notified affected individuals, OCR, and the media of this breach incident. BBH established a toll free call center and offered affected individuals identity monitoring and protection services and terminated its relationship with the BA. OCR obtained assurances that the covered entity implemented the corrective actions noted above.
