Gillette Medical Imaging

On December 1, 2017, Gillette Medical Imaging, the covered entity (CE), discovered that its former business associate (BA) mistakenly mailed its medical billing records to other providers in the same geographical area. The breach affected over 500 individuals, and included names, addresses, social security numbers, dates of birth, insurance claims information, bank and credit card account numbers, diagnoses, lab results, and medications. The CE provided breach notification to affected individuals, the media, and HHS. OCR verified that the CE had proper BA agreements in place that restrict the BA’s use and disclosure of PHI and required the BA to safeguard all PHI. In resolving the breach, OCR provided the CE with technical assistance regarding reasonable safeguards, device and media controls, disclosures to business associates, business associate agreements, reportable breach assessment, and the Breach Notification Rule.