High Plains Surgical Associates

On October 31, 2017, the covered entity (CE), High Plains Surgical Associates, discovered that its former business associate (BA) mistakenly mailed its medical billing records to other health care providers in the same geographical area. Additionally, the former BA sent other providers’ medical billing records to the CE. The breach reportedly affected over 500 individuals, and the protected health information (PHI) impermissibly disclosed included names, addresses, social security numbers, and clinical information. The CE provided breach notification to affected individuals, the media, and HHS. OCR verified that the CE had compliant BA agreements in place that restrict the BA’s use and disclosure of PHI and require the BA to safeguard all PHI. OCR provided technical assistance regarding reasonable safeguards, disclosures to BAs, BA agreements, reportable breach risk assessments, and its additional obligations under the Breach Notification Rule.