Indiana University School of Optometry

A doctor's letters and reports were exposed on the Internet for one month after the security configuration of the covered entity's (CE) computer server was changed. The electronic protected health information (ePHI) of 757 individuals appearing on the Internet included patient names, birth dates, medical histories, diagnoses, and treatment plans. Following the breach, the CE identified and blocked the internet protocol (IP) address that was allowing access to ePHI over the Internet, removed the web portal that was facilitating access, and restored the affected server to its previous security configuration. As a result of OCR's investigation, the CE implemented monitoring and reporting of electronic information systems that transmit ePHI. OCR obtained assurances that breach notification was provided to affected individuals, the media, and HHS.