Franciscan Health, Highline Medical Center

A business associate (BA) inadvertently left files containing the covered entity’s (CE) patient information accessible via the internet from mid-April 2016 to June 13, 2016. The BA assured the CE, CHI Franciscan Health, Highline Medical Center, that it secured the files on June 13, 2016. The types of ePHI involved included patients names, dates of service, health insurance information, and social security numbers and affected approximately 18,399 individuals. OCR reviewed the applicable BA agreement that was in place at the time of the breach. Following the breach, the CE discontinued its BA relationship with the BA. In addition, the BA provided validation that it deleted all of the files in its computer systems that contained information about the CE’s patients. OCR obtained assurances that the CE notified all affected individuals, submitted notification to the media offered free credit monitoring services to all living affected individuals, and created a 24/7 call center for patients and other concerned individuals, so that such individuals could get up-to-date information on the breach and receive assistance as needed.