Health Incent

Health Incent, the covered entity (CE), discovered on June 8, 2016 that a patient database containing electronic protected health information (ePHI) was available on the internet through web searches. The breach affected 1,100 individuals and the types of ePHI involved in the breach included patient names, dates of birth, email addresses, and mailing addresses. The CE provided timely breach notification to HHS, affected individuals, and the media. The CE successfully contacted all affected individuals who did not receive the initial notification. In response to the breach, CE sanctioned those responsible for the breach and created a new process for uploading files to its website. OCR obtained assurances from CE that it implemented the corrective actions noted above.