Carolina Oncology Specialists

On or about August 11, 2017, the covered entity (CE), Carolina Oncology Specialists, received correspondence from credit card companies addressed to three of its patients using the CE’s address. On September 6, 2017, one of the three patients reported a suspicious credit card transaction to the CE. The CE investigated and found that the perpetrator of the fraudulent transaction was a former employee who had had access to 1,551 patient files containing names, addresses, birthdates, social security numbers, and some medical information. The former employee had legitimate access to these files as an employee and it is unclear how many records she accessed in an unauthorized manner. In response to the breach, the CE notified the police and initiated an internal investigation. The police identified the same employee as the prime suspect for misusing patient information to open fraudulent credit card accounts. The CE found that there was no unauthorized access to its network or electronic medical records in the days immediately preceding the incident. To prevent such an incident in the future, the CE implemented additional technical safeguards to better track users on its network and lim