Center for Neurosurgical & Spine Disorders

An unauthorized user remotely accessed a workstation computer from the covered entity (CE), Center for Neurosurgical & Spine Disorders, LLC. The types of protected health information (PHI) accessed by the unauthorized user included the names, addresses, phone numbers, social security numbers, medical chart information, and billing information of 824 individuals. Upon discovering the breach, the CE notified the Federal Bureau of Investigation, notified the three major consumer credit reporting agencies, and provided free credit monitoring to affected individuals. The CE provided breach notification to HHS, affected individuals, and the media. Further, the CE improved its technical security posture and retrained staff. OCR obtained assurances that the CE implemented the corrective actions listed.