Heartland Pathology Associates

Heartland Pathology Associates, P.A., the covered entity (CE), discovered that its past business associate (BA), Medical Business Service, Inc., suffered a breach when an employee downloaded protected health information (PHI) to a portable computer drive and provided the drive to a third party. The breach affected 1,175 individuals and included patients' names, addresses, telephone numbers, social security numbers, dates of birth, insurance carriers, insurance policy numbers, physicians' name, diagnosis information, medical record numbers, account numbers, admission and discharge dates, and gender. The CE delayed providing breach notification due to a law enforcement investigation. Once given approval, the CE timely sent breach notification to HHS, affected individuals, and the media and posted substitute notification online. The CE contracted with Florida Hospital Heartland Medical Center (“Hospital”) for annual HIPAA training and for use of a computer maintained and monitored by the Hospital’s information technology department. The CE received assurances that PHI maintained by its BA was destroyed. OCR obtained assurances that the CE has implemented the corrective actions listed