Dermatology Center of Raleigh

On June 21, 2017, the covered entity (CE), The Dermatology Center of Raleigh, PA, discovered that its employee sent a patient list to a Sona Dermatology & Med Spa (“Sona”) employee in an unsecure/unencrypted email format. The patient list contained the names, account numbers, and telephone numbers of 3,000 individuals. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE and Sona formally entered into a management services agreement and Sona improved safeguards by implementing encryption solutions and strengthened its access policy and procedures to enable only authorized users to access the minimum necessary information needed to perform job functions. The CE invested in equipment, applications and software to detect human errors and malware, duplication of data, and to prevent improper data integration. OCR provided technical assistance regarding the definition of a breach, the low probability of compromise factors, and the Breach Notification Rule. OCR obtained assurances that the CE met its notification requirements and implemented the corrective actions listed above.