On July 19, 2018, the covered entity (CE) learned that an employee uploaded a file containing limited member information to a public-facing website that was publicly accessible between April 23, 2018, and July 20, 2018. The types of protected health information involved in the breach included demographic, clinical, and health claims information for approximately 16,762 subscribers. The CE immediately took steps to ensure the file was permanently removed from the website, and launched an investigation to determine the nature and scope of this incident, working with a forensics investigation firm. The CE noted that the website involved was under development by the employee and was not well known or marketed to the public. The CE undertook multiple efforts to obtain data from the website hosting company, but efforts did not yield meaningful results, as the company hosting the website was not able to provide any data to the CE for the period of time that the file was accessible. The CE provided breach notification to HHS, affected individuals, and the media and provided credit monitoring services to those affected. OCR reviewed the individual breach notification letters, as well as the
