CareCentrix, Inc., the covered entity (CE), reported that its business associate (BA), American Medical Collection Agency, discovered unauthorized access to its web payment portal. The breach affected 467,621 individuals and the protected health information (PHI) involved included identification numbers, insurance information, names, dates of birth, addresses, phone numbers, social security numbers, and financial information. CareCentrix notified all affected individuals as well as the media. As a result of the breach, CareCentrix dissolved its business associate relationship.
