Feinstein and Roe Mds

On August 21, 2017, the covered entity (CE), Feinstein and Roe Mds Inc., notified OCR that it had received suspicious reports from people purporting to be from the Kaiser Permanente Privacy Compliance Department, alleging that the CE’s patient records had been released onto the dark web. The breach involved the protected health information (PHI) including demographic information (i.e., patients’ addresses, dates of birth, names, and social security numbers) of 6,642 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE strengthened password requirements, provided affected individuals with free credit monitoring, revised policies and procedures, and trained workforce members. As a result of OCR’s investigation, the CE provided OCR with documentation regarding staff training, security reminders, and copies of its policies and procedures.