Duke LifePoint Conemaugh Memorial Medical Center

An employee of the covered entity’s (CE) business associate (BA), Medical Management, LLC (“MML”), disclosed the demographic information of 1,551 of the CE’s patients to outside parties. The protected health information (PHI) involved in the breach included names, dates of birth, and social security numbers. Following the breach, the CE assisted the BA in responding to the breach and notifying affected individuals. Additionally, OCR reviewed the CE’s risk analysis to ensure compliance with the Security Rule