On April 19, 2013, the credit card information of 1,924 patients of the covered entity (CE), Piedmont HealthCare, P.A., was compromised via a breach of a website hosted by one of the CE’s vendors, E-dreamz. An unauthorized person gained access to E-dreamz’s servers and obtained payment information of the CE’s patients. The protected health information (PHI) involved in the breach included patients’ names, addresses, phone numbers, email addresses, and credit card information. The CE provided breach notification to HHS, the media, and affected individuals, and offered them a year of free credit monitoring and identity theft protection. Following the breach, the CE terminated its agreement with E-dreamz and entered into a business associate (BA) agreement with a new website hosting vendor. The CE also initiated legal proceedings against E-dreamz regarding its breach of contract for storing credit card information on its server and other issues related to this incident. OCR obtained assurances that the CE implemented the corrective actions listed.
