A business associate (BA), Avatar Solutions, e-mailed satisfaction surveys for patients who visited Memorial Medical Group, a provider affiliate of the covered entity (CE), Comanche County Hospital Authority, to incorrect e-mail addresses. The surveys contained patients’ and providers’ names and affected 2,199 individuals. In response to the incident, the BA updated its Security Management Plan, implemented new technical safeguards, applied policy changes to mitigate harm, and implemented training to prevent further incidents. In response to OCR’s investigation, the CE provided evidence it provided breach notification to the media and affected individuals and offered affected individuals a year of free credit monitoring and identity theft protection.
