Insurance Data Services

On September 15, 2015, a zippered bag was stolen from a delivery service vehicle with month-end reports for Insurance Data Services, a business associate (BA) of the covered entity (CE), Claystone Clinical Associates. The BA reported that this breach affected 2,918 individuals. The types of protected health information (PHI) involved in the breach included patients’ names, dates of service, balances, insurance providers, diagnostic and procedure codes, addresses, and phone numbers. The BA investigated the breach and assured that the theft was reported to the police. The BA provided breach notification to HHS, affected individuals, and the media. The BA also updated its procedures to utilize a secure client portal to transmit PHI with clients. As a result of OCR’s investigation the BA created policies and procedures relating to safeguarding PHI, using and disclosing PHI, and Breach Rule Notification and trained its staff on its policies. OCR obtained written assurances that the CE completed the corrective actions listed.